Vulnerability GHSA-p44q-fmwr-jqr7

Medium Risk

3 months ago

Jenkins Contrast Continuous Application Security Plugin has a missing permission check

1.0.0 - 1.4.0 and 1.6.0 - 3.7.0 and 3.9.0 - 3.11.0

Summary

Jenkins Contrast Continuous Application Security Plugin has a missing permission check

Details

Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Contrast Continuous Application Security Plugin 3.12 requires Overall/Administer permission and POST requests to test the connection to a Contrast TeamServer.