CVE-2019-16559: CSRF
A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
Other sources
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to perform connection tests, determine whether files with an attacker-specified path exist on the Jenkins controller file system, and obtain limited information about the Jenkins and plugin configuration based on the responses. The latter include the ability to set plugin configuration options.
Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16559?
The severity of CVE-2019-16559 is medium with a CVSS score of 5.4.
What is the affected software of CVE-2019-16559?
The affected software of CVE-2019-16559 is Jenkins WebSphere Deployer Plugin 1.6.1 and earlier.
Are there any permission checks missing in CVE-2019-16559?
Yes, CVE-2019-16559 has a missing permission check in methods performing form validation.
What actions can users with Overall/Read access perform in CVE-2019-16559?
Users with Overall/Read access in CVE-2019-16559 can perform connection tests and determine the existence of files on the Jenkins controller file system.
Is there any additional information available for CVE-2019-16559?
Yes, you can find additional information about CVE-2019-16559 at the following references: [http://www.openwall.com/lists/oss-security/2019/12/17/1](http://www.openwall.com/lists/oss-security/2019/12/17/1), [https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371](https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371), [https://nvd.nist.gov/vuln/detail/CVE-2019-16559](https://nvd.nist.gov/vuln/detail/CVE-2019-16559).