Jenkins JClouds Plugin cross-site request forgery vulnerability

高 8.8CVE-2019-10368 · GHSA-87hx-q65g-r35x · 07/08/2019 公開 · 17/06/2026 更新

要点

CVE-2019-10368 は org.jenkins-ci.plugins:jclouds-jenkins, jclouds (jenkins) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 64.7% より高い）。
対処：2.15 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:jclouds-jenkins Maven	`< 2.15`	`2.15`
jclouds jenkins	`≤ 2.14`	修正版なし

概要

Jenkins JClouds Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer permission.

NVD の説明

A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.