CVE-2018-1000153: CSRF
A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000153?
CVE-2018-1000153 has been classified as a cross-site request forgery vulnerability that could allow an attacker to perform unauthorized actions on behalf of a user.
How do I fix CVE-2018-1000153?
To fix CVE-2018-1000153, you should upgrade the Jenkins vSphere Plugin to version 2.17 or later.
Which versions of Jenkins vSphere Plugin are affected by CVE-2018-1000153?
Versions of the Jenkins vSphere Plugin up to and including 2.16 are affected by CVE-2018-1000153.
What components of Jenkins are impacted by CVE-2018-1000153?
CVE-2018-1000153 impacts several components including Clone.java, Delete.java, and Deploy.java among others.
Is CVE-2018-1000153 exploitable without authentication?
Yes, CVE-2018-1000153 can be exploited by an attacker without requiring authentication, as it is a cross-site request forgery vulnerability.