CVE-2017-1000090: CSRF
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000090?
CVE-2017-1000090 is considered a high severity vulnerability due to its potential for cross-site request forgery attacks.
How do I fix CVE-2017-1000090?
To fix CVE-2017-1000090, update the Role-based Authorization Strategy Plugin to version 2.5.1 or later.
What software is affected by CVE-2017-1000090?
CVE-2017-1000090 affects Jenkins Role-based Authorization Strategy Plugin versions up to 2.5.0.
What types of attacks are enabled by CVE-2017-1000090?
CVE-2017-1000090 enables cross-site request forgery, allowing unauthorized users to modify user roles and permissions.
What does CVE-2017-1000090 allow an attacker to do?
CVE-2017-1000090 allows an attacker to add administrator roles to any user or remove authorization configurations.