CVE-2018-1999027

Description

An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java. SaltStack Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and to cause Jenkins to submit HTTP requests to attacker-specified URLs. Additionally, these form validation methods did not require POST requests, resulting in a CSRF vulnerability. As of version 3.1.7, these form validation methods require POST requests and Overall/Administer permissions.

How to fix CVE-2018-1999027

To remediate CVE-2018-1999027, upgrade the affected package to a fixed version below.

• —upgrade to 3.1.7 or later

Is CVE-2018-1999027 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 3.1.7

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-1999027
• PATCHgithub.com/jenkinsci/saltstack-plugin
• WEBgithub.com/jenkinsci/saltstack-plugin/commit/5306bcc438ff989e4b1999a0208fd6854979999b
• WEBjenkins.io/security/advisory/2018-07-30/#SECURITY-1009