Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery

2023-05-1618:30:16

Google

osv.dev

jenkins

ldap

plugin

cross-site request forgery

vulnerability

csrf

form validation

attackers

ldap server

credentials

software

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.0005 Low

EPSS

Percentile

16.4%

JSON

Jenkins LDAP Plugin 673.v034ec70ec2b_b_ and earlier does not require POST requests for a form validation method, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.

LDAP Plugin 676.vfa_64cf6b_b_002 requires POST requests for the affected form validation method.

CPENameOperatorVersion
org.jenkins-ci.plugins:ldapeq1.3
org.jenkins-ci.plugins:ldapeq1.10.1
org.jenkins-ci.plugins:ldapeq1.15
org.jenkins-ci.plugins:ldapeq1.19
org.jenkins-ci.plugins:ldapeq1.0
org.jenkins-ci.plugins:ldapeq1.25
org.jenkins-ci.plugins:ldapeq1.17
org.jenkins-ci.plugins:ldapeq1.11
org.jenkins-ci.plugins:ldapeq1.4
org.jenkins-ci.plugins:ldapeq2.0

Name	Operator	Version
org.jenkins-ci.plugins:ldap	eq	1.3
org.jenkins-ci.plugins:ldap	eq	1.10.1
org.jenkins-ci.plugins:ldap	eq	1.15
org.jenkins-ci.plugins:ldap	eq	1.19
org.jenkins-ci.plugins:ldap	eq	1.0
org.jenkins-ci.plugins:ldap	eq	1.25
org.jenkins-ci.plugins:ldap	eq	1.17
org.jenkins-ci.plugins:ldap	eq	1.11
org.jenkins-ci.plugins:ldap	eq	1.4
org.jenkins-ci.plugins:ldap	eq	2.0