Jenkins Subversion Plugin CVE-2017-1000085 Cross Site Request Forgery Vulnerability

Bugtraq ID:	99574
Class:	Input Validation Error
CVE:	CVE-2017-1000085
Remote:	Yes
Local:	No
Published:	Jul 13 2017 12:00AM
Updated:	Jul 13 2017 12:00AM
Credit:	Jesse Glick, CloudBees, Inc.
Vulnerable:	Jenkins Subversion Plugin 2.8
Not Vulnerable:	Jenkins Subversion Plugin 2.9

Jenkins Subversion Plugin CVE-2017-1000085 Cross Site Request Forgery Vulnerability

Subversion Plugin for Jenkins is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Subversion Plugin version 2.8 and prior are vulnerable.

Jenkins Subversion Plugin CVE-2017-1000085 Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.

Jenkins Subversion Plugin CVE-2017-1000085 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jenkins Subversion Plugin CVE-2017-1000085 Cross Site Request Forgery Vulnerability

References:

• Jenkins CI Homepage (Jenkins CI)
  
• Jenkins Security Advisory 2017-02-01 (jenkins)