CVE-2021-22512: CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Summary
CVE-2021-22512: CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin. Affects org.jenkins-ci.plugins:hp-application-automation-tools-plugin versions < 6.8. Fixed in 6.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Micro Focus Application Automation Tools Plugin is a Maven package that provides functionality for Jenkins, an open-source automation server. This plugin allows users to connect to various URLs using specified credentials and perform automated tasks. However, versions 6.7 and earlier of the plugin have a vulnerability that allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password. This vulnerability also exposes a cross-site request forgery (CSRF) risk as the affected form validation methods do not require POST requests.
Vulnerability Detail
The CSRF vulnerability in the Micro Focus Application Automation Tools Plugin allows attackers with Overall/Read permission to connect to arbitrary URLs using specified credentials. This can lead to unauthorized access and potential misuse of the plugin's functionality. Additionally, the lack of POST request requirement in form validation methods opens up the possibility of CSRF attacks, where an attacker can trick a user into performing unintended actions on the plugin. The vulnerability has a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
How To Fix
Minimum fixed version
6.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the latest version of the plugin.
Conclusion
The Micro Focus Application Automation Tools Plugin has a CSRF vulnerability that allows attackers with Overall/Read permission to connect to arbitrary URLs using specified credentials. Upgrading to version 6.8 or later of the plugin is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:hp-application-automation-tools-plugin →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to arbitrary URLs using specified credentials. It can lead to unauthorized access and potential misuse of the plugin's functionality.
To fix this vulnerability, it is recommended to upgrade to version 6.8 or later of the Micro Focus Application Automation Tools Plugin.
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the latest version of the plugin.
CSRF stands for Cross-Site Request Forgery. It is a type of attack where an attacker tricks a user into performing unintended actions on a web application. In this case, the CSRF vulnerability allows an attacker to perform actions on the Micro Focus Application Automation Tools Plugin using the user's credentials.
The CVSS score of this vulnerability is 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:hp-application-automation-tools-plugin.
