[JCLOUDS-1536] SECURITY-1482 / CVE-2019-10368 (CSRF), CVE-2019-10369 (permission check)

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Invalid
• Affects Version/s: 1.9.1
• Assignee: Unassigned
• Reporter: xingyunyang
• Created: 07/Jan/20 00:46
• Updated: 07/Jan/20 10:11
• Resolved: 07/Jan/20 10:11

Description

SECURITY-1482 / CVE-2019-10368 (CSRF), CVE-2019-10369 (permission check)
JClouds Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

 

Has the problem been fixed？If the problem has been fixed, please tell me the "commitid" for fixed version.Thanks