CVE-2019-10368: CSRF
A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Other sources
Jenkins JClouds Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.
This form validation method now requires POST requests and Overall/Administer permission.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10368?
CVE-2019-10368 is classified as a cross-site request forgery (CSRF) vulnerability with a medium severity impact.
Who is affected by CVE-2019-10368?
Users with Overall/Read access in Jenkins JClouds Plugin versions 2.14 and earlier are affected by CVE-2019-10368.
How do I fix CVE-2019-10368?
To fix CVE-2019-10368, upgrade the Jenkins JClouds Plugin to version 2.15 or later.
What can an attacker do with CVE-2019-10368?
An attacker can exploit CVE-2019-10368 to connect to an attacker-specified URL using attacker-specified credentials.
How does CVE-2019-10368 impact Jenkins security?
CVE-2019-10368 compromises Jenkins security by allowing unauthorized connections to arbitrary URLs, potentially leading to data exposure or manipulation.