CVE-2019-10315

描述

Jenkins GitHub Authentication Plugin did not manage the state parameter of OAuth to prevent CSRF. This allowed an attacker to catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins account would be attached to the attacker’s GitHub account. The state parameter is now correctly managed.

如何修補 CVE-2019-10315

要修補 CVE-2019-10315,請將受影響套件升級到下列已修補版本。

• —升級至 0.32 或更新版本

CVE-2019-10315 正在被利用嗎?

低 — EPSS 為 2.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.32

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-10315
• WEBwww.openwall.com/lists/oss-security/2019/04/30/5
• WEBjenkins.io/security/advisory/2019-04-30/#SECURITY-443
• WEBweb.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159