GHSA-rf7h-9m85-535v

Jenkins Publisher Over CIFS Plugin confused deputy vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1999038

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:publish-over-cifs	< 0.11	0.11

Details

As written in the advisory (Markdown source, shown as plain text).

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 0.11, this form validation method requires POST requests and Overall/Administer permissions.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1999038 advisory
https://github.com/jenkinsci/publish-over-cifs-plugin/commit/9402d8c1044508c2fc30a5dd1e34afe6819616a0 web
https://github.com/jenkinsci/publish-over-cifs-plugin package
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975 web