CVE-2023-50769: CSRF
Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Nexus Platform Plugin 3.18.1-01 requires POST requests and Overall/Administer permission for the affected form validation methods.
Other sources
Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50769?
CVE-2023-50769 is considered a high severity vulnerability due to its potential to allow unauthorized connections to arbitrary HTTP servers.
How do I fix CVE-2023-50769?
To fix CVE-2023-50769, upgrade the Jenkins Nexus Platform Plugin to version 3.18.1-01 or later.
Who is affected by CVE-2023-50769?
Users of Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier are affected by CVE-2023-50769.
What kind of permissions do attackers need to exploit CVE-2023-50769?
Attackers need Overall/Read permission to exploit CVE-2023-50769.
What is the nature of the vulnerability in CVE-2023-50769?
CVE-2023-50769 allows attackers to bypass permission checks in form validation methods, enabling them to connect to an attacker-specified HTTP server.