CVE-2023-32989: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier allows attackers to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
Other sources
Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Azure VM Agents Plugin 853.v4a1add947520 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32989?
CVE-2023-32989 is classified as a high severity vulnerability.
How do I fix CVE-2023-32989?
To fix CVE-2023-32989, upgrade to Jenkins Azure VM Agents Plugin version 853.v4a or later.
What does CVE-2023-32989 affect?
CVE-2023-32989 affects Jenkins Azure VM Agents Plugin versions 852.v8d35f0960a_43 and earlier.
What is a cross-site request forgery (CSRF) vulnerability in the context of CVE-2023-32989?
In the context of CVE-2023-32989, CSRF allows attackers to perform actions on behalf of authenticated users without their consent.
Who can be exploited by CVE-2023-32989?
Attackers who have obtained credentials IDs through another method can exploit CVE-2023-32989 to connect to an attacker-specified Azure Cloud server.