CVE-2023-32990: CSRF
A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
Other sources
Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Azure VM Agents Plugin 853.v4a1add947520 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32990?
CVE-2023-32990 is classified as a high-severity vulnerability due to the potential for unauthorized access to Azure Cloud servers.
How do I fix CVE-2023-32990?
To mitigate CVE-2023-32990, upgrade the Jenkins Azure VM Agents Plugin to version 853.v4a or later.
What systems are affected by CVE-2023-32990?
CVE-2023-32990 affects Jenkins Azure VM Agents Plugin version 852.v8d35f0960a_43 and earlier.
Who can exploit CVE-2023-32990?
Attackers with Overall/Read permission in Jenkins can exploit CVE-2023-32990 to connect to Azure Cloud servers using specified credentials.
What type of vulnerability is CVE-2023-32990?
CVE-2023-32990 is a permission check vulnerability that allows unauthorized access to cloud resources.