Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

MEDIO 6.5CVE-2018-1999032 · GHSA-pwrm-8mvm-p2f2 · Published 01/08/2018 · updated 17/06/2026

In breve

CVE-2018-1999032 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda org.jenkins-ci.plugins:pangolin-testrail-connector, pangolin connector for testrail (agiletestware).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 63.5% delle vulnerabilità.
Correzione: aggiornare a 2.2 o successiva.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:pangolin-testrail-connector Maven	`< 2.2`	`2.2`
pangolin connector for testrail agiletestware	`≤ 2.1`	No fix yet

Description

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1999032 · ADVISORY
jenkinsci/pangolin-testrail-connector-plugin commit 53dac44 · WEB
jenkinsci/pangolin-testrail-connector-plugin · PACKAGE
jenkins.io/security/advisory/2018-07-30 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In breve

CVE-2018-1999032 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda org.jenkins-ci.plugins:pangolin-testrail-connector, pangolin connector for testrail (agiletestware).

Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 63.5% delle vulnerabilità.

Correzione: aggiornare a 2.2 o successiva.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:pangolin-testrail-connector

Maven

< 2.2

2.2

pangolin connector for testrail

agiletestware

≤ 2.1

No fix yet

Description

NVD description