What is the severity of CVE-2018-1000153?

CVE-2018-1000153 has been classified as a cross-site request forgery vulnerability that could allow an attacker to perform unauthorized actions on behalf of a user.

How do I fix CVE-2018-1000153?

To fix CVE-2018-1000153, you should upgrade the Jenkins vSphere Plugin to version 2.17 or later.

Which versions of Jenkins vSphere Plugin are affected by CVE-2018-1000153?

Versions of the Jenkins vSphere Plugin up to and including 2.16 are affected by CVE-2018-1000153.

What components of Jenkins are impacted by CVE-2018-1000153?

CVE-2018-1000153 impacts several components including Clone.java, Delete.java, and Deploy.java among others.

Is CVE-2018-1000153 exploitable without authentication?

Yes, CVE-2018-1000153 can be exploited by an attacker without requiring authentication, as it is a cross-site request forgery vulnerability.

Vulnerability/
CVE-2018-1000153

high

8.8

CWE

352

5/4/2018

3/10/2022

5/8/2024

CVE-2018-1000153: CSRF

First published: Thu Apr 05 2018(Updated: )

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Jenkins Vsphere	<=2.16

Never miss a vulnerability like this again

Reference Links

https://jenkins.io/security/advisory/2018-03-26/#SECURITY-745

Frequently Asked Questions

What is the severity of CVE-2018-1000153?
CVE-2018-1000153 has been classified as a cross-site request forgery vulnerability that could allow an attacker to perform unauthorized actions on behalf of a user.
How do I fix CVE-2018-1000153?
To fix CVE-2018-1000153, you should upgrade the Jenkins vSphere Plugin to version 2.17 or later.
Which versions of Jenkins vSphere Plugin are affected by CVE-2018-1000153?
Versions of the Jenkins vSphere Plugin up to and including 2.16 are affected by CVE-2018-1000153.
What components of Jenkins are impacted by CVE-2018-1000153?
CVE-2018-1000153 impacts several components including Clone.java, Delete.java, and Deploy.java among others.
Is CVE-2018-1000153 exploitable without authentication?
Yes, CVE-2018-1000153 can be exploited by an attacker without requiring authentication, as it is a cross-site request forgery vulnerability.

collector/nvd-index
agent/type
agent/softwarecombine
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/references
agent/tags
agent/author
agent/weakness
agent/event
agent/description
agent/source
vendor/jenkins
canonical/jenkins vsphere
version/jenkins vsphere/2.16

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2018-1000153?
CVE-2018-1000153 has been classified as a cross-site request forgery vulnerability that could allow an attacker to perform unauthorized actions on behalf of a user.
How do I fix CVE-2018-1000153?
To fix CVE-2018-1000153, you should upgrade the Jenkins vSphere Plugin to version 2.17 or later.
Which versions of Jenkins vSphere Plugin are affected by CVE-2018-1000153?
Versions of the Jenkins vSphere Plugin up to and including 2.16 are affected by CVE-2018-1000153.
What components of Jenkins are impacted by CVE-2018-1000153?
CVE-2018-1000153 impacts several components including Clone.java, Delete.java, and Deploy.java among others.
Is CVE-2018-1000153 exploitable without authentication?
Yes, CVE-2018-1000153 can be exploited by an attacker without requiring authentication, as it is a cross-site request forgery vulnerability.