CVE-2017-1000085: Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
Summary
CVE-2017-1000085: Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability. Affects org.jenkins-ci.plugins:subversion versions < 2.9. Fixed in 2.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Subversion Plugin is a component of Jenkins, an open-source automation server. It allows users to connect to a user-specified Subversion repository and perform various actions, such as retrieving a list of tags. This functionality was vulnerable to a Cross-Site Request Forgery (CSRF) attack, which could be exploited by users with Item/Build permission. The plugin did not properly check permissions, allowing unauthorized users to connect to web servers or Subversion servers and potentially capture credentials. The vulnerability also allowed CSRF attacks without direct access to Jenkins. This issue was addressed in version 2.9 of the plugin.
Vulnerability Detail
The vulnerability in the Jenkins Subversion Plugin allowed users with Item/Build permission to connect to any web server or Subversion server and send credentials with a known ID. This could lead to unauthorized access and potential credential theft. The plugin did not require POST requests, making it susceptible to CSRF attacks. The impact of this vulnerability could be significant, as it could compromise the security of Subversion repositories and expose sensitive information.
How To Fix
Minimum fixed version
2.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to upgrade to the latest version of the Subversion Plugin as soon as possible.
Conclusion
The Jenkins Subversion Plugin was vulnerable to a Cross-Site Request Forgery (CSRF) attack, allowing unauthorized users to connect to servers and potentially capture credentials. Upgrading to version 2.9 or later of the plugin is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:subversion →
FAQ
The vulnerability allows unauthorized users to connect to web servers or Subversion servers and potentially capture credentials. It also enables CSRF attacks without direct access to Jenkins, posing a significant security risk.
Users of the Subversion Plugin versions prior to 2.9 are affected by this vulnerability.
Yes, upgrading to version 2.9 or later of the Subversion Plugin will fix this vulnerability.
There are no known exploits for this vulnerability at the moment.
You can find more information about this vulnerability in the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:subversion.
