GHSA-2g32-2j8w-2qgf: High severity Jenkins vSphere Plugin vulnerability

Q: What does an attacker need to exploit this issue?

The attack is cross-site request forgery, so exploitation requires a victim to interact with attacker-controlled content while using Jenkins. No attacker authentication is indicated by the provided severity vector.

Q: Which Jenkins vSphere Plugin installations are affected?

Jenkins vSphere Plugin version 2.16 and older is affected. The issue is present in multiple plugin form-validation endpoints, including test-connection functionality.

Q: What is the practical impact of the vulnerable validation endpoints?

An attacker can cause Jenkins to send numerous requests to the configured vSphere server, which can potentially result in denial of service. They can also cause credentials stored in Jenkins under a known ID to be sent to an attacker-specified server through test-connection behavior.

Published Apr 5, 2018

Updated

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").

Affected Software

1 affected component

Jenkins vSphere Plugin<=2.16

Event History

Apr 5, 2018

CVE Published

via OSV·01:29 PM

Data Sourced

via OSV·01:29 PM

DescriptionSeverity

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack is cross-site request forgery, so exploitation requires a victim to interact with attacker-controlled content while using Jenkins. No attacker authentication is indicated by the provided severity vector.

Which Jenkins vSphere Plugin installations are affected?

Jenkins vSphere Plugin version 2.16 and older is affected. The issue is present in multiple plugin form-validation endpoints, including test-connection functionality.

What is the practical impact of the vulnerable validation endpoints?

An attacker can cause Jenkins to send numerous requests to the configured vSphere server, which can potentially result in denial of service. They can also cause credentials stored in Jenkins under a known ID to be sent to an attacker-specified server through test-connection behavior.

GHSA-2g32-2j8w-2qgf: High severity Jenkins vSphere Plugin vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Jenkins vSphere Plugin installations are affected?

What is the practical impact of the vulnerable validation endpoints?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Jenkins vSphere Plugin installations are affected?

What is the practical impact of the vulnerable validation endpoints?