CVE-2019-10308: Missing permission check in Jenkins Static Analysis Utilities Plugin
Summary
CVE-2019-10308: Missing permission check in Jenkins Static Analysis Utilities Plugin. Affects org.jvnet.hudson.plugins:analysis-core versions < 1.96. Fixed in 1.96. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Static Analysis Utilities Plugin is a Maven package that provides various utilities for static analysis in Jenkins. It allows users to configure default graph configurations for jobs. However, a vulnerability in versions 1.95 and earlier of the plugin allowed attackers with Overall/Read permission to modify the per-job default graph configuration for all users.
Vulnerability Detail
The vulnerability (CVE-2019-10308) in the Jenkins Static Analysis Utilities Plugin arises from a missing permission check in the DefaultGraphConfigurationView#doSave form handler method. This allows attackers with Overall/Read permission to change the per-job default graph configuration for all users. The impact of this vulnerability is moderate, as it can potentially lead to unauthorized modification of graph configurations, affecting the visualization and analysis of static analysis results.
How To Fix
Minimum fixed version
1.96
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to upgrade to the fixed version of the plugin.
Conclusion
In conclusion, the Jenkins Static Analysis Utilities Plugin versions 1.95 and earlier are vulnerable to a missing permission check that allows unauthorized modification of default graph configurations. Users should upgrade to version 1.96 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jvnet.hudson.plugins:analysis-core →
FAQ
The impact of this vulnerability is moderate, as it allows attackers with Overall/Read permission to modify the per-job default graph configuration for all users.
Users of Jenkins Static Analysis Utilities Plugin versions 1.95 and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment.
Yes, users should upgrade to version 1.96 or later of the Jenkins Static Analysis Utilities Plugin to fix this vulnerability.
There is no specific workaround mentioned for this vulnerability. Users are advised to upgrade to the fixed version of the plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jvnet.hudson.plugins:analysis-core.
