GHSA-2mh9-wpgv-7xr8MediumCVSS 4.3

Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information

Published
May 13, 2022
Last Modified
December 20, 2023

🔗 CVE IDs covered (1)

📋 Description

\Jenkins Cloud Foundry Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer (for global configuration) or Item/Configure permissions (for job configuration).

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:cloudfoundry:<= 2.3.1

🔗 References (5)