GHSA-63jg-5wv6-7ghv

Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource

Source: GitHub Advisory Database (reviewed) Low CVE-2018-1999037

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:resource-disposer	< 0.12	0.12

Details

As written in the advisory (Markdown source, shown as plain text).

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a specified resource. Additionally, this API endpoint did not require POST requests, resulting in a CSRF vulnerability. As of version 0.12, this API endpoint requires POST requests and Overall/Administer permissions.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1999037 advisory
https://github.com/jenkinsci/resource-disposer-plugin/commit/d826a99b06cc46c5dfadfd526b519ef0f65c8682 web
https://github.com/jenkinsci/resource-disposer-plugin package
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-997 web