CVE-2023-4301: Jenkins Fortify Plugin Cross-Site Request Forgery Vulnerability
Summary
CVE-2023-4301: Jenkins Fortify Plugin cross-site request forgery vulnerability. Affects org.jenkins-ci.plugins:fortify versions < 22.2.39. Fixed in 22.2.39. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Fortify Plugin is a Maven package that provides integration with Fortify, a software security tool. It allows users to scan their code for potential vulnerabilities and generate reports. The plugin is widely used in Jenkins, an open-source automation server. This vulnerability affects versions 22.1.38 and earlier of the Fortify Plugin.
Vulnerability Detail
The Jenkins Fortify Plugin versions 22.1.38 and earlier have a cross-site request forgery (CSRF) vulnerability. The plugin does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to a URL of their choice using credentials obtained through another method. This can lead to the capture of credentials stored in Jenkins. Additionally, these endpoints do not require POST requests, making them vulnerable to CSRF attacks. The vulnerability is rated as moderate with a CVSS score of 4.2.
How To Fix
Minimum fixed version
22.2.39
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Fortify Plugin as soon as possible.
Conclusion
The Jenkins Fortify Plugin versions 22.1.38 and earlier are vulnerable to a cross-site request forgery (CSRF) attack. Upgrading to version 22.2.39 or later of the plugin is necessary to fix this vulnerability. It is recommended to take immediate action to upgrade and ensure the security of your Jenkins installation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fortify →
FAQ
This vulnerability allows attackers to connect to a specified URL using stolen credentials, potentially compromising sensitive information stored in Jenkins.
Users of Jenkins Fortify Plugin versions 22.1.38 and earlier are affected by this vulnerability.
Yes, the attacker needs Overall/Read permission in Jenkins and access to credentials IDs obtained through another method.
Upgrading to version 22.2.39 or later of the Fortify Plugin is the recommended mitigation for this vulnerability.
Yes, the CVSS score for this vulnerability is 4.2 (moderate).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fortify.
