GHSA-mm5c-7mpr-99fm

CSRF vulnerability in Jenkins Libvirt Agents Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2021-21627

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:libvirt-slave	< 1.9.1	1.9.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Libvirt Agents Plugin 1.9.0 and earlier does not require POST requests for a form submission endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to stop hypervisor domains. Jenkins Libvirt Agents Plugin 1.9.1 requires POST requests for the affected HTTP endpoint.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21627 advisory
https://github.com/jenkinsci/libvirt-slave-plugin/commit/655eab9bde26e8b8e11034f6c405af374564cae7 web
https://github.com/jenkinsci/libvirt-slave-plugin package
https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-1764 web
http://www.openwall.com/lists/oss-security/2021/03/18/5 web