CVE-2018-1999037: Input Validation

Q: Which deployments are affected?

Jenkins installations using Resource Disposer Plugin version 0.11 or earlier are affected.

Q: What access does an attacker need to exploit the resource-tracking issue?

The reported severity vector indicates low privileges are required and that the issue is reachable over the network without user interaction. The vulnerable endpoint could be used to stop tracking a specified resource.

Q: Why does the CSRF aspect matter?

The affected API endpoint did not require POST requests, creating a CSRF condition. Version 0.12 changes the endpoint to require POST requests and Overall/Administer permission.

Q: What should be done if the plugin cannot be updated immediately?

The provided data does not specify a workaround. Updating to version 0.12 or later is the documented remediation, because it adds POST enforcement and Overall/Administer permission requirements.

Published Aug 1, 2018

Updated

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource.

Other sources

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a specified resource. Additionally, this API endpoint did not require POST requests, resulting in a CSRF vulnerability. As of version 0.12, this API endpoint requires POST requests and Overall/Administer permissions.

Affected Software

2 affected componentsFixes available

Jenkins Resource Disposer Jenkins<=0.11

maven/org.jenkins-ci.plugins:resource-disposer<=0.11

0.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/org.jenkins-ci.plugins:resource-disposer to a version that resolves this vulnerability.
Fixed in 0.12
Upgrade
Upgrade Jenkins Resource Disposer Plugin to a version that resolves this vulnerability.
Fixed in 0.12

Event History

Aug 1, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

Data Sourced

via OSV·01:29 PM

DescriptionSeverity

May 14, 2022

Advisory Published

02:45 AM

Frequently Asked Questions

Which deployments are affected?

Jenkins installations using Resource Disposer Plugin version 0.11 or earlier are affected.

What access does an attacker need to exploit the resource-tracking issue?

The reported severity vector indicates low privileges are required and that the issue is reachable over the network without user interaction. The vulnerable endpoint could be used to stop tracking a specified resource.

Why does the CSRF aspect matter?

The affected API endpoint did not require POST requests, creating a CSRF condition. Version 0.12 changes the endpoint to require POST requests and Overall/Administer permission.

What should be done if the plugin cannot be updated immediately?

The provided data does not specify a workaround. Updating to version 0.12 or later is the documented remediation, because it adds POST enforcement and Overall/Administer permission requirements.

CVE-2018-1999037: Input Validation

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit the resource-tracking issue?

Why does the CSRF aspect matter?

What should be done if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit the resource-tracking issue?

Why does the CSRF aspect matter?

What should be done if the plugin cannot be updated immediately?