CVE-2019-16559

描述

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to perform connection tests, determine whether files with an attacker-specified path exist on the Jenkins controller file system, and obtain limited information about the Jenkins and plugin configuration based on the responses. The latter include the ability to set plugin configuration options. Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability. As of publication of this advisory, there is no fix.

如何修補 CVE-2019-16559

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2019-16559 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 1.6.1

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-16559
• WEBwww.openwall.com/lists/oss-security/2019/12/17/1
• WEBjenkins.io/security/advisory/2019-12-17/#SECURITY-1371