GitHub Advisoryadvisory · Maven

GHSA-rf7h-9m85-535v Jenkins Publisher Over CIFS Plugin confused deputy vulnerability

MEDIUM Published 2022-05-14 Modified 2022-12-12 Official page ↗
Aliases
CVE-2018-1999038
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:publish-over-cifs
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-441
Reviewed
2022-12-12

Affected packages

• Maven org.jenkins-ci.plugins:publish-over-cifs: < 0.11 → fixed in 0.11

Description

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 0.11, this form validation method requires POST requests and Overall/Administer permissions.

Related

Alias · CVE (1)

  • CVE-2018-1999038 A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that… vulnerability

Weakness · CWE (1)

  • CWE-441 Unintended Proxy or Intermediary weakness

References