CVE-2019-10441: Jenkins iceScrum Plugin Cross-site Request Forgery Vulnerability
Summary
CVE-2019-10441: Jenkins iceScrum Plugin vulnerable to Cross-site Request Forgery. Affects org.jenkins-ci.plugins:icescrum versions < 1.1.6. Fixed in 1.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins iceScrum Plugin is a Maven package that integrates the iceScrum project management tool with Jenkins. It allows users to create, manage, and track iceScrum projects directly from Jenkins. The plugin provides seamless integration between the two tools, enabling developers to streamline their project management and continuous integration processes.
Vulnerability Detail
A cross-site request forgery (CSRF) vulnerability has been discovered in the Jenkins iceScrum Plugin prior to version 1.1.6. This vulnerability allows attackers to trick authenticated users into performing unintended actions on their behalf. By exploiting this vulnerability, an attacker can connect to a URL of their choice using the credentials of the targeted user. This can lead to unauthorized access, data manipulation, or other malicious activities. The issue has been assigned the CVE identifier CVE-2019-10441 and has a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
How To Fix
Minimum fixed version
1.1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the latest version to mitigate the risk of CSRF attacks.
Conclusion
The Jenkins iceScrum Plugin prior to version 1.1.6 is vulnerable to a CSRF attack. To mitigate this vulnerability, it is crucial to update the plugin to version 1.1.6 or later. This update includes a patch that addresses the CSRF vulnerability and prevents attackers from exploiting it. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:icescrum →
FAQ
A CSRF vulnerability allows an attacker to trick authenticated users into performing unintended actions on their behalf. By exploiting this vulnerability, an attacker can perform actions on a website or web application using the victim's credentials without their knowledge or consent.
The CSRF vulnerability in the Jenkins iceScrum Plugin can lead to unauthorized access, data manipulation, or other malicious activities. Attackers can exploit this vulnerability to perform actions on behalf of authenticated users, potentially compromising the integrity and security of the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins iceScrum Plugin version is vulnerable to this CSRF vulnerability. Simply enter your Maven package URL (pkg:maven/org.jenkins-ci.plugins/icescrum) and the Vulert Playground will provide real-time information on the vulnerability status.
No, there are no known workarounds for this vulnerability. It is crucial to update the Jenkins iceScrum Plugin to the latest version (1.1.6 or later) to mitigate the risk of CSRF attacks.
You can find more information about this vulnerability, including its CVE identifier (CVE-2019-10441) and the patch details, in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rxvx-9wg5-qpww/GHSA-rxvx-9wg5-qpww.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:icescrum.
