Lucene search

K
osvGoogleOSV:GHSA-2MH9-WPGV-7XR8
HistoryMay 13, 2022 - 1:15 a.m.

Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information

2022-05-1301:15:21
Google
osv.dev
2
jenkins
cloud foundry
sensitive information
permission checks
form validation
post requests
cross-site request forgery vulnerability

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

41.3%

\Jenkins Cloud Foundry Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer (for global configuration) or Item/Configure permissions (for job configuration).

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

41.3%

Related for OSV:GHSA-2MH9-WPGV-7XR8