CVE-2023-25767: Cross-Site Request Forgery in Jenkins Azure Credentials Plugin
Summary
CVE-2023-25767: Cross-Site Request Forgery in Jenkins Azure Credentials Plugin. Affects org.jenkins-ci.plugins:azure-credentials versions < 254.v64da_8176c83a. Fixed in 254.v64da_8176c83a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Azure Credentials Plugin is a Maven package (org.jenkins-ci.plugins:azure-credentials) that provides functionality for managing Azure credentials within Jenkins. It allows users to securely store and use Azure credentials for various operations within Jenkins, such as connecting to Azure services. However, versions 253.v887e0f9e898b and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins Azure Credentials Plugin allows attackers to perform a CSRF attack by tricking a user into visiting a malicious website. When the user visits the website, the attacker can connect to an attacker-specified web server, potentially leading to unauthorized access or other malicious activities. This vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
254.v64da_8176c83a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the plugin to the latest version to mitigate the risk of CSRF attacks.
Conclusion
The Jenkins Azure Credentials Plugin is vulnerable to a CSRF attack, which can be mitigated by upgrading to version 254 or later. It is crucial to keep Jenkins and its plugins up to date to ensure the security of your Jenkins installation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:azure-credentials →
FAQ
This vulnerability allows attackers to connect to an attacker-specified web server, potentially leading to unauthorized access or other malicious activities.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, upgrading the Jenkins Azure Credentials Plugin to version 254 or later will fix this vulnerability.
No, there are no known workarounds for this vulnerability. Updating the plugin is the recommended solution.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:azure-credentials.
