GHSA-m295-m3x4-3mmc

Jenkins Libvirt Slaves Plugin vlnerable to Cross-Site Request Forgery

Source: GitHub Advisory Database (reviewed) High CVE-2019-10471

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:libvirt-slave	< 1.8.6	1.8.6

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10471 advisory
https://github.com/jenkinsci/libvirt-slave-plugin/commit/231c41e0e4ecb2d25247cc2775e1fe18d64a1703 web
https://github.com/jenkinsci/libvirt-slave-plugin package
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1014%20(1) web
http://www.openwall.com/lists/oss-security/2019/10/23/2 web