GHSA-mxf8-grm7-mvqw

Suggest an improvement
Source
https://github.com/advisories/GHSA-mxf8-grm7-mvqw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mxf8-grm7-mvqw/GHSA-mxf8-grm7-mvqw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mxf8-grm7-mvqw
Aliases
Published
2022-05-24T17:03:47Z
Modified
2024-02-16T08:08:36.089200Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Jenkins WebSphere Deployer Plugin missing permission check
Details

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to perform connection tests, determine whether files with an attacker-specified path exist on the Jenkins controller file system, and obtain limited information about the Jenkins and plugin configuration based on the responses. The latter include the ability to set plugin configuration options.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory, there is no fix.

References

Affected packages

Maven / org.jenkins-ci.plugins:websphere-deployer

Package

Name
org.jenkins-ci.plugins:websphere-deployer
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/websphere-deployer

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.6.1

Affected versions

1.*

1.1
1.2
1.3.4
1.5.5
1.5.6
1.6.0
1.6.1