SB2023012607 - Multiple vulnerabilities in Jenkins JIRA Pipeline Steps plugin
Published: January 26, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Cross-site request forgery (CVE-ID: CVE-2023-24437)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
2) Improper access control (CVE-ID: CVE-2023-24438)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in methods implementing form validation. A remote user can connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
3) Cleartext storage of sensitive information (CVE-ID: CVE-2023-24439)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to the affected plugin stores the private key unencrypted in its global configuration file org.thoughtslive.jenkins.plugins.jira.JiraStepsConfig.xml on the Jenkins controller as part of its configuration. A local user can gain access to this key.
4) Improper access control (CVE-ID: CVE-2023-24440)
The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the global configuration form does not mask the API key. A local user can observe and capture it.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.