CVE-2018-1000153: CSRF
First published: Thu Apr 05 2018(Updated: )
A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins | <=2.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2018-1000153?
CVE-2018-1000153 has been classified as a cross-site request forgery vulnerability that could allow an attacker to perform unauthorized actions on behalf of a user.
How do I fix CVE-2018-1000153?
To fix CVE-2018-1000153, you should upgrade the Jenkins vSphere Plugin to version 2.17 or later.
Which versions of Jenkins vSphere Plugin are affected by CVE-2018-1000153?
Versions of the Jenkins vSphere Plugin up to and including 2.16 are affected by CVE-2018-1000153.
What components of Jenkins are impacted by CVE-2018-1000153?
CVE-2018-1000153 impacts several components including Clone.java, Delete.java, and Deploy.java among others.
Is CVE-2018-1000153 exploitable without authentication?
Yes, CVE-2018-1000153 can be exploited by an attacker without requiring authentication, as it is a cross-site request forgery vulnerability.
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/weakness
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/jenkins
- canonical/jenkins
- version/jenkins/2.16