Lucene search

Veracode Vulnerability DatabaseVERACODE:41345

HistoryJul 18, 2023 - 9:45 p.m.

Cross-Site Request Forgery (CSRF)

2023-07-1821:45:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

http endpoints

jenkins

credentials

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

23.4%

JSON

org.jenkins-ci.plugins:elasticbox is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability is due to not requiring POST requests for HTTP endpoints, allowing an attacker to connect to nefarious URLs using credentials obtained in another way, resulting in stealing credentials from Jenkins’ saved credentials.

CPENameOperatorVersion
elasticbox ci plug-inle4.0.8
elasticbox ci plug-inle4.0.8

CPE	Name	Operator	Version
	elasticbox ci plug-in	le	4.0.8
	elasticbox ci plug-in	le	4.0.8

References

www.openwall.com/lists/oss-security/2023/07/12/2

github.com/advisories/GHSA-5v46-54vj-4mjq

www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3131

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

23.4%

JSON

Related for VERACODE:41345