CVE-2019-10456

MEDIUM4.3EPSS 0.23%

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerability

Published: 5/24/2022Modified: 2/16/2024

Description

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password. Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability. As of publication of this advisory there is no fix.

Affected packages (1)

Maven/org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classicfrom 0, <= 1.0.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References (2)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-10456
WEBhttps://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462