Description
A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins JClouds Plugin | 2.14 and earlier | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:jclouds-jenkins | < 2.15 | 2.15 | GHSA-7wxc-7qrg-rg6w |
References
- [oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins mailing-list
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482
- [jclouds-notifications] 20200106 [jira] [Created] (JCLOUDS-1536) SECURITY-1482 / CVE-2019-10368 (CSRF), CVE-2019-10369 (permission check) mailing-list
- [jclouds-notifications] 20200107 [jira] [Resolved] (JCLOUDS-1536) SECURITY-1482 / CVE-2019-10368 (CSRF), CVE-2019-10369 (permission check) mailing-list
- [jclouds-notifications] 20200107 [jira] [Commented] (JCLOUDS-1536) SECURITY-1482 / CVE-2019-10368 (CSRF), CVE-2019-10369 (permission check) mailing-list