ghsa-cqp4-cv7h-7jp5
Vulnerability from github
Published
2022-05-14 01:09
Modified
2022-12-12 16:31
Severity ?
VLAI Severity ?
Summary
Jenkins SaltStack Plugin allows attackers to capture credentials with a known credentials ID stored in Jenkins
Details
An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java. SaltStack Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and to cause Jenkins to submit HTTP requests to attacker-specified URLs. Additionally, these form validation methods did not require POST requests, resulting in a CSRF vulnerability. As of version 3.1.7, these form validation methods require POST requests and Overall/Administer permissions.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.6"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:saltstack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1999027"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-12T16:31:10Z",
"nvd_published_at": "2018-08-01T13:29:00Z",
"severity": "MODERATE"
},
"details": "An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java. SaltStack Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and to cause Jenkins to submit HTTP requests to attacker-specified URLs. Additionally, these form validation methods did not require POST requests, resulting in a CSRF vulnerability. As of version 3.1.7, these form validation methods require POST requests and Overall/Administer permissions.\n\n",
"id": "GHSA-cqp4-cv7h-7jp5",
"modified": "2022-12-12T16:31:10Z",
"published": "2022-05-14T01:09:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1999027"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/saltstack-plugin/commit/5306bcc438ff989e4b1999a0208fd6854979999b"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/saltstack-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins SaltStack Plugin allows attackers to capture credentials with a known credentials ID stored in Jenkins"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…