CVE-2023-50775: Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin
Summary
CVE-2023-50775: Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin. Affects org.jenkins-ci.plugins:ec2-deployment-dashboard versions < 1.0.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Deployment Dashboard Plugin is a Maven package that provides a dashboard for managing deployments in Jenkins. It allows users to monitor and control the deployment of applications to various environments. The plugin integrates with Jenkins and provides a user-friendly interface for managing deployment jobs.
Vulnerability Detail
A cross-site request forgery (CSRF) vulnerability has been discovered in the Jenkins Deployment Dashboard Plugin version 1.0.10 and earlier. This vulnerability allows attackers to copy jobs without proper authorization. By tricking a user into visiting a malicious website or clicking on a specially crafted link, an attacker can perform unauthorized actions on behalf of the user, including copying jobs and potentially gaining access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Jenkins Deployment Dashboard Plugin.
Conclusion
The Jenkins Deployment Dashboard Plugin is vulnerable to a CSRF vulnerability that allows unauthorized job copying. It is crucial for users to upgrade to the latest version of the plugin to mitigate this risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ec2-deployment-dashboard →
FAQ
A CSRF vulnerability allows an attacker to perform unauthorized actions on behalf of a user by tricking them into visiting a malicious website or clicking on a specially crafted link.
This vulnerability allows attackers to copy jobs in Jenkins without proper authorization. It can lead to unauthorized access to sensitive information and potential disruption of deployment processes.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, a patched version of the Jenkins Deployment Dashboard Plugin is available. It is recommended to upgrade to the latest version to fix the CSRF vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/advisories/GHSA-v672-5x3h-57qp).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ec2-deployment-dashboard.
