CVE-2019-10408: Jenkins Project Inheritance Plugin Cross-Site Request Forgery
Summary
CVE-2019-10408: Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery. Affects hudson.plugins:project-inheritance versions < 19.08.2. Fixed in 19.08.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Project Inheritance Plugin is a Maven package that enables the creation of projects based on predefined templates. It provides users with the ability to create new projects quickly and efficiently by utilizing these templates. However, a vulnerability has been identified in the plugin that allows for Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability in the Jenkins Project Inheritance Plugin arises from a missing permission check in the HTTP endpoint responsible for triggering project creation. This flaw allows users with Overall/Read permission to create projects without proper authorization. Additionally, the HTTP endpoint does not enforce the use of POST requests, making it susceptible to CSRF attacks. An attacker could exploit this vulnerability to perform unauthorized actions on behalf of a user with Overall/Read permission. The impact of this vulnerability could range from unauthorized project creation to potential data manipulation or theft.
How To Fix
Minimum fixed version
19.08.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can protect themselves by ensuring that only trusted users have Overall/Read permission and by updating to the latest version of the Jenkins Project Inheritance Plugin.
Conclusion
The Jenkins Project Inheritance Plugin is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a missing permission check and the absence of POST request enforcement. Users are advised to update to the latest version of the plugin and ensure that only trusted users have Overall/Read permission. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hudson.plugins:project-inheritance →
FAQ
The Jenkins Project Inheritance Plugin is a Maven package that allows users to create projects based on predefined templates, simplifying the project creation process.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the context of this vulnerability, it allows an attacker to perform unauthorized actions on behalf of a user with Overall/Read permission.
The impact of this vulnerability could range from unauthorized project creation to potential data manipulation or theft.
To fix this vulnerability, update your Jenkins Project Inheritance Plugin to version 19.08.2 or later.
While there is no specific workaround provided, users can protect themselves by ensuring that only trusted users have Overall/Read permission and by updating to the latest version of the Jenkins Project Inheritance Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for hudson.plugins:project-inheritance.
