Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 25 Mar 2019 17:17:44 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Re: Multiple vulnerabilities in Jenkins plugins



> On 25. Mar 2019, at 16:09, Daniel Beck <ml@...kweb.net> wrote:
> 
> SECURITY-976
> Notification Plugin Plugin did not perform permission checks on a method 
> implementing form validation. This allowed users with Overall/Read access 
> to Jenkins to connect to an attacker-specified URL using attacker-specified 
> credentials IDs obtained through another method, capturing credentials 
> stored in Jenkins.
> 
> Additionally, this form validation method did not require POST requests, 
> resulting in a cross-site request forgery vulnerability.

Correction: This is about Slack Notification Plugin.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.