Cross-Site Request Forgery Vulnerability in Jenkins Deploy WebLogic Plugin
CVE-2019-10464

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Deploy Weblogic Plugin
Vendor
CVE Published:
23 October 2019

Summary

A cross-site request forgery vulnerability has been identified in the Jenkins Deploy WebLogic Plugin. This security issue allows malicious actors to send forged requests to Jenkins, potentially using attacker-defined credentials to access unauthorized URLs. Additionally, it may enable an attacker to ascertain the existence of specific files or directories within the Jenkins master file system based on a user-specified path. This presents significant risks to sensitive data and system integrity. It is crucial for users to update to the latest version of the plugin to mitigate these risks.

Affected Version(s)

Jenkins Deploy WebLogic Plugin 4.1 and earlier

References

https://jenkins.io/security/advisory/2019-10-23/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/10/23/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.