GHSA-fjh2-qhfh-rvfc

Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1999030

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:maven-artifact-choicelistprovider	< 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1999030 advisory
https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/2d2e20cc00a29abf435afcad12cfc9ddadf76d89 web
https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/5a3a3ff1e7416623c531601620305640ef4c8e28 web
https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/99d97c028fbc0672b729d052d4bfc4dfa9674f23 web
https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin package
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1022 web