Improper Authentication Affecting org.jenkins-ci.plugins:audit-trail package, versions [,3.7)


0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.09% (35th percentile)
Expand this section
NVD
5.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-1016918
  • published 9 Oct 2020
  • disclosed 9 Oct 2020
  • credit Daniel Beck, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.

How to fix?

Upgrade org.jenkins-ci.plugins:audit-trail to version 3.7 or higher.

Overview

org.jenkins-ci.plugins:audit-trail is a Jenkins plugin that keeps a log of who performed particular Jenkins operations, such as configuring jobs.

Affected versions of this package are vulnerable to Improper Authentication. It logs requests whose URL path matches an admin-configured regular expression.A discrepancy between the behavior of the plugin and the Stapler web framework in parsing URL paths allows attackers to craft URLs that would bypass request logging in Audit Trail Plugin 3.6 and earlier. This only applies to Jenkins 2.227 and earlier, LTS 2.204.5 and earlier, as the fix for Audit Trail Plugin 3.7 processes request URL paths the same way as the Stapler web framework.