From 78d356b16b16ad8b40353b014e6c59023dfd90e2 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 26 Oct 2023 23:09:27 +0000 Subject: [PATCH] Publish Advisories GHSA-4c2w-wcw4-8jv9 GHSA-5rc5-4c5c-4cwx GHSA-4c2w-wcw4-8jv9 GHSA-5rc5-4c5c-4cwx --- .../GHSA-4c2w-wcw4-8jv9.json | 64 +++++++++++++++++++ .../GHSA-5rc5-4c5c-4cwx.json | 57 +++++++++++++++++ .../GHSA-4c2w-wcw4-8jv9.json | 38 ----------- .../GHSA-5rc5-4c5c-4cwx.json | 38 ----------- 4 files changed, 121 insertions(+), 76 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json diff --git a/advisories/github-reviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json b/advisories/github-reviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json new file mode 100644 index 00000000000..5929750ab9a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4c2w-wcw4-8jv9", + "modified": "2023-10-26T23:09:04Z", + "published": "2022-05-24T16:58:50Z", + "aliases": [ + "CVE-2019-10454" + ], + "summary": "Jenkins Rundeck Plugin CSRF vulnerability", + "details": "Jenkins Rundeck Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password.\n\nAdditionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:rundeck" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.6.5" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10454" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/rundeck-plugin/commit/68177fc53f40d038233c9d54f3d59fdee9d6ced0" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-10-26T23:09:04Z", + "nvd_published_at": "2019-10-16T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json b/advisories/github-reviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json new file mode 100644 index 00000000000..0410d2d5419 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json @@ -0,0 +1,57 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5rc5-4c5c-4cwx", + "modified": "2023-10-26T23:07:40Z", + "published": "2022-05-24T16:58:50Z", + "aliases": [ + "CVE-2019-10452" + ], + "summary": "Jenkins View26 Test-Reporting Plugin stores access token in plain text", + "details": "Jenkins View26 Test-Reporting Plugin stores an access token unencrypted in job `config.xml` files on the Jenkins controller. This token can be viewed by users with Extended Read permission or access to the Jenkins controller file system.\n\nAs of publication of this advisory there is no fix.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:view26" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10452" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1440" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-312" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-10-26T23:07:40Z", + "nvd_published_at": "2019-10-16T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json b/advisories/unreviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json deleted file mode 100644 index a526fbadf69..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-4c2w-wcw4-8jv9/GHSA-4c2w-wcw4-8jv9.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4c2w-wcw4-8jv9", - "modified": "2023-10-25T18:31:29Z", - "published": "2022-05-24T16:58:50Z", - "aliases": [ - "CVE-2019-10454" - ], - "details": "A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10454" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-10-16T14:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json b/advisories/unreviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json deleted file mode 100644 index 3cc87be77a3..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5rc5-4c5c-4cwx/GHSA-5rc5-4c5c-4cwx.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5rc5-4c5c-4cwx", - "modified": "2023-10-25T18:31:29Z", - "published": "2022-05-24T16:58:50Z", - "aliases": [ - "CVE-2019-10452" - ], - "details": "Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10452" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1440" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-312" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-10-16T14:15:00Z" - } -} \ No newline at end of file