Jenkins Fortify Plugin cross-site request forgery vulnerability

中 5.4CVE-2023-4301 · GHSA-3fjv-8r82-6xm9 · 21/08/2023 公開 · 17/06/2026 更新

要点

CVE-2023-4301 は org.jenkins-ci.plugins:fortify, fortify (jenkins) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.22%（全脆弱性の 13.1% より高い）。
対処：22.2.39 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:fortify Maven	`< 22.2.39`	`22.2.39`
fortify jenkins	`< 22.2.39`	`22.2.39`

概要

Jenkins Fortify Plugin 22.1.38 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Fortify Plugin 22.2.39 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

NVD の説明

A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.