CVE-2023-40351: Jenkins Favorite View Plugin cross-site request forgery vulnerability
Summary
CVE-2023-40351: Jenkins Favorite View Plugin cross-site request forgery vulnerability. Affects org.jenkins-ci.plugins:favorite-view versions < 5.v77a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Favorite View Plugin is a Maven package that provides functionality for managing favorite views in the Jenkins continuous integration and delivery platform. It allows users to customize their view tabs and easily access their preferred views. However, versions 5.v77a_37f62782d and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins Favorite View Plugin arises from its failure to enforce the use of POST requests for an HTTP endpoint. This oversight enables an attacker to perform CSRF attacks, where they can add or remove views from another user's favorite views tab bar. This can lead to unauthorized manipulation of a user's Jenkins interface and potential disruption of their workflow. As of now, there is no available fix for this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. Users are advised to prioritize updating the plugin to a fixed version as soon as it becomes available.
Conclusion
The Jenkins Favorite View Plugin is susceptible to a cross-site request forgery vulnerability that allows unauthorized manipulation of a user's favorite views. To mitigate this risk, it is crucial to update the plugin to a fixed version as soon as it becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:favorite-view →
FAQ
The vulnerability allows an attacker to manipulate another user's favorite views in Jenkins, potentially disrupting their workflow and causing confusion.
Yes, this vulnerability can be exploited remotely by tricking a user into visiting a malicious website or clicking on a crafted link.
At present, there are no known mitigations for this vulnerability. It is crucial to update the plugin to a fixed version as soon as it becomes available.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
For further information and support on vulnerability remediation, please contact info@devnack.com.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
