CVE-2019-10456

MEDIUM4.3EPSS 0.23%

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerability

發布日:2022/5/24修改日:2024/2/16

描述

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password. Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability. As of publication of this advisory there is no fix.

受影響套件(1)

Maven/org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classicfrom 0, <= 1.0.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

參考連結(2)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-10456
WEBhttps://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462