Lucene search

GitHub Advisory DatabaseGHSA-C9QP-6556-JWWP

HistoryMay 16, 2023 - 6:30 p.m.

Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery

2023-05-1618:30:16

CWE-352

GitHub Advisory Database

github.com

jenkins

ldap

plugin

csrf

vulnerability

cross-site request forgery

post

form validation

attackers

ldap server

credentials

software

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.0005 Low

EPSS

Percentile

16.4%

JSON

Jenkins LDAP Plugin 673.v034ec70ec2b_b_ and earlier does not require POST requests for a form validation method, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.

LDAP Plugin 676.vfa_64cf6b_b_002 requires POST requests for the affected form validation method.

Affected configurations

Vulners

Node

org.jenkinsci.plugins\Matchldap

CPENameOperatorVersion
org.jenkins-ci.plugins:ldaplt676.vfa

CPE	Name	Operator	Version
	org.jenkins-ci.plugins:ldap	lt	676.vfa

References

github.com/advisories/GHSA-c9qp-6556-jwwp

github.com/jenkinsci/ldap-plugin/commit/fa64cf6bb002f1b60a45fcd308d45b5a1047e687

nvd.nist.gov/vuln/detail/CVE-2023-32978

www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3046

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.0005 Low

EPSS

Percentile

16.4%

JSON

Related for GHSA-C9QP-6556-JWWP