Jenkins Libvirt Slaves Plugin vlnerable to Cross-Site Request Forgery

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-10471 · ADVISORY
• jenkinsci/libvirt-slave-plugin commit 231c41e · WEB
• jenkinsci/libvirt-slave-plugin · PACKAGE
• jenkins.io/security/advisory/2019-10-23 · WEB
• openwall.com/lists/oss-security/2019/10/23/2 · WEB
• jenkins.io/security/advisory/2019-10-23

org.jenkins-ci.plugins:libvirt-slave のその他の脆弱性

• CVE-2021-21627高 8.8A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor dom…
• CVE-2019-10473中 4.3A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate cred…
• CVE-2019-10472中 6.5A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specifie…