CVE-2019-10437: Jenkins CRX Content Package Deployer Plugin Cross-Site Request Forgery
Summary
CVE-2019-10437: Jenkins CRX Content Package Deployer Plugin subject to Cross-Site Request Forgery. Affects org.jenkins-ci.plugins:crx-content-package-deployer versions < 1.9. Fixed in 1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins CRX Content Package Deployer Plugin is a Maven package for Jenkins that allows users to deploy content packages to Adobe CRX repositories. It provides functionality for managing and deploying content packages in a Jenkins environment. This plugin is vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins CRX Content Package Deployer Plugin allows attackers to perform CSRF attacks by connecting to an attacker-specified URL using attacker-specified credentials IDs obtained through another method. This allows the attacker to capture credentials stored in Jenkins. The vulnerability has a CVSS score of 8.8, indicating a high severity level. The issue has been patched in version 1.9 of the plugin.
How To Fix
Minimum fixed version
1.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to upgrade to the patched version as soon as possible.
Conclusion
The Jenkins CRX Content Package Deployer Plugin is vulnerable to a CSRF attack that allows attackers to capture credentials stored in Jenkins. Users should upgrade to version 1.9 of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:crx-content-package-deployer →
FAQ
The vulnerability allows attackers to perform CSRF attacks and capture credentials stored in Jenkins, potentially leading to unauthorized access and data breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for open-source vulnerabilities in real-time.
Yes, the vulnerability has been patched in version 1.9 of the Jenkins CRX Content Package Deployer Plugin. Users are advised to upgrade to this version to mitigate the CSRF vulnerability.
To update the plugin, follow the standard update process in Jenkins. Go to the Manage Jenkins section, select Manage Plugins, and search for the Jenkins CRX Content Package Deployer Plugin. Click on the checkbox next to the plugin and click the Install button to update it to the latest version.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-62fp-j75q-mqhc/GHSA-62fp-j75q-mqhc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:crx-content-package-deployer.
