https://bugzilla.redhat.com/show_bug.cgi?id=1561287
Bug ID: 1561287 Summary: CVE-2018-8718 jenkins-plugin-mailer: Missing permissions check in Mailer.java:doSendTestMail() allows unauthorised users to send mail Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: sfowler@redhat.com CC: ahardin@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dbaker@redhat.com, dedgar@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, kseifried@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com
The Jenkins Mailer Plugin through version 1.20 is missing a permissions check in the Mailer.java:doSendTestMail() function. Users with Overall/Read access are able to connect to a user-specified mail server with user-specified credentials to send a test email to a user-specified email address. The email subject and body could not be changed. This could result in DoS if, for example, specifying a valid mail server but invalid credentials.
As the same URL did not require POST to be used, it also was vulnerable to cross-site request forgery.
Upstream Advisory:
https://jenkins.io/security/advisory/2018-03-26/
Upstream Patch:
https://github.com/jenkinsci/mailer-plugin/commit/98e79cf904769907f83894e29f...
https://bugzilla.redhat.com/show_bug.cgi?id=1561287
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1561288
--- Comment #1 from Sam Fowler sfowler@redhat.com --- Created jenkins-mailer-plugin tracking bugs for this issue:
Affects: fedora-all [bug 1561288]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1561288 [Bug 1561288] CVE-2018-8718 jenkins-mailer-plugin: jenkins-plugin-mailer: Missing permissions check in Mailer.java:doSendTestMail() allows unauthorised users to send mail [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1561287
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1561289
https://bugzilla.redhat.com/show_bug.cgi?id=1561287
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018 |0326,reported=20180328,sour |0326,reported=20180328,sour |ce=internet,cvss3=6.4/CVSS: |ce=internet,cvss3=6.4/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:C |3.0/AV:N/AC:L/PR:L/UI:N/S:C |/C:N/I:L/A:L,cwe=CWE-862,fe |/C:N/I:L/A:L,cwe=CWE-862,fe |dora-all/jenkins-mailer-plu |dora-all/jenkins-mailer-plu |gin=affected,openshift-ente |gin=affected,openshift-ente |rprise-3/jenkins-mailer-plu |rprise-3/jenkins-mailer-plu |gin=new |gin=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1561287
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1565297
java-sig-commits@lists.fedoraproject.org