Jenkins Role-based Authorization Strategy Plugin Cross Site Request Forgery Vulnerability

Bugtraq ID:	100312
Class:	Input Validation Error
CVE:	CVE-2017-1000090
Remote:	Yes
Local:	No
Published:	Jul 10 2017 12:00AM
Updated:	Jul 10 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Jenkins-Ci Role-based Authorization Strategy Plugin 2.5
Not Vulnerable:	Jenkins-Ci Role-based Authorization Strategy Plugin 2.5.1

Jenkins Role-based Authorization Strategy Plugin Cross Site Request Forgery Vulnerability

Role-based Authorization Strategy Plugin for Jenkins is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Role-based Authorization Strategy Plugin version 2.5.0 and prior are vulnerable.

Jenkins Role-based Authorization Strategy Plugin Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.

Jenkins Role-based Authorization Strategy Plugin Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jenkins Role-based Authorization Strategy Plugin Cross Site Request Forgery Vulnerability

References:

• Jenkins CI Homepage (Jenkins CI)
  
• Jenkins Security Advisory 2017-07-10 (Jenkins)