A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade atomic-openshift-dockerregistryUpgrade jenkinsUpgrade golang-github-prometheus-alertmanagerUpgrade haproxyUpgrade openshift-enterprise-autohealUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-service-idlerUpgrade openshift-ansibleUpgrade atomic-openshiftUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-metrics-serverUpgrade golang-github-openshift-oauth-proxyUpgrade golang-github-prometheus-prometheusUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-web-consoleUpgrade jenkins-2-pluginsUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-node-problem-detector | Mar 15, 2019 | Jan 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub