CVE-2018-1000013: CSRF vulnerability in Jenkins Release plugin
Summary
CVE-2018-1000013: CSRF vulnerability in Jenkins Release plugin. Affects org.jenkins-ci.plugins:release versions < 2.10. Fixed in 2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Release Plugin is a Maven plugin that allows users to automate the release process of their software projects. It provides functionality for creating release builds and managing the release process. The plugin is widely used in the Jenkins ecosystem and is an integral part of many CI/CD pipelines.
Vulnerability Detail
The Jenkins Release Plugin version 2.9 and earlier did not enforce the use of POST requests for form submissions, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. This means that an attacker could trick a user into performing unintended actions, such as triggering release builds, by tricking them into visiting a malicious website or clicking on a specially crafted link. This vulnerability has a CVSS score of 8.8, indicating a high severity.
How To Fix
Minimum fixed version
2.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the Jenkins Release Plugin as soon as possible.
Conclusion
The Jenkins Release Plugin version 2.9 and earlier is vulnerable to a CSRF attack that allows attackers to trigger release builds. To mitigate this vulnerability, users should upgrade to version 2.10 or later of the plugin. There are no known workarounds for this issue. It is recommended to check your Jenkins installation for this vulnerability using the Vulert Playground and contact DevNack.com for further support.
See every vulnerability recorded for org.jenkins-ci.plugins:release →
FAQ
This vulnerability allows attackers to trigger release builds in Jenkins, potentially leading to unauthorized software releases or other unintended actions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to patch your Jenkins installation to prevent potential attacks.
Yes, this vulnerability is identified as CVE-2018-1000013.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:release.
