CVE-2019-10332: CSRF
A missing permission check in a form validation method in CloudBees CD Plugin allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password.
Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
Other sources
A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-10332.
What is the name of the affected software?
The affected software is Jenkins ElectricFlow Plugin.
What is the severity level of CVE-2019-10332?
The severity level of CVE-2019-10332 is medium with a severity value of 4.3.
How can an attacker exploit this vulnerability?
Attackers with Overall/Read permission can initiate a connection test to an attacker-specified server with an attacker-specified username and password.
Are there any fixes available for this vulnerability?
Yes, the vulnerability can be fixed by updating to version 1.1.6 or later.