CVE-2020-2203: CSRF vulnerability in Jenkins Fortify on Demand Plugin
Summary
CVE-2020-2203: CSRF vulnerability in Jenkins Fortify on Demand Plugin. Affects org.jenkins-ci.plugins:fortify-on-demand-uploader versions < 6.0.0. Fixed in 6.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Fortify on Demand Plugin is a Maven-based plugin that allows users to connect to the globally configured Fortify on Demand endpoint. It provides integration with Fortify on Demand, a cloud-based application security testing service. The plugin enables users to upload their build artifacts to Fortify on Demand for static code analysis and vulnerability scanning. By leveraging the plugin, developers can identify and address security vulnerabilities in their codebase.
Vulnerability Detail
A cross-site request forgery (CSRF) vulnerability has been discovered in Jenkins Fortify on Demand Plugin version 5.0.1 and earlier. This vulnerability allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. By exploiting this vulnerability, an attacker can perform unauthorized actions on behalf of a victim user, potentially compromising the security and integrity of the application. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
6.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Jenkins Fortify on Demand Plugin.
Conclusion
The CSRF vulnerability in Jenkins Fortify on Demand Plugin poses a moderate risk to the security of applications utilizing this plugin. It is crucial for users to upgrade to the latest version of the plugin (6.0.0 or later) to mitigate the vulnerability. Vulnerability monitoring tools like Vulert Playground can be used to assess the impact of this vulnerability on your application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fortify-on-demand-uploader →
FAQ
This vulnerability allows attackers to connect to the Fortify on Demand endpoint using unauthorized credentials, potentially leading to unauthorized access and manipulation of sensitive data.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is crucial to apply the recommended fix to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely. Attackers can craft malicious requests to connect to the Fortify on Demand endpoint using unauthorized credentials.
Yes, a patch is available for this vulnerability. Users should upgrade to Jenkins Fortify on Demand Plugin version 6.0.0 or later to apply the fix.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fortify-on-demand-uploader.
