Lucene search

GoogleOSV:GHSA-6CVR-RVPM-9WX4

HistorySep 22, 2022 - 12:00 a.m.

Jenkins SCM HttpClient Plugin vulnerable to Cross-Site Request Forgery

2022-09-2200:00:26

Google

osv.dev

jenkins

scm httpclient plugin

cross-site request forgery

http server

credentials ids

csrf

vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

34.3%

JSON

SCM HttpClient Plugin 1.5 and earlier does not perform permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

References

www.openwall.com/lists/oss-security/2022/09/21/5

github.com/jenkinsci/scm-httpclient-plugin

nvd.nist.gov/vuln/detail/CVE-2022-41249

www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2708

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

34.3%

JSON

Related for OSV:GHSA-6CVR-RVPM-9WX4