CVE-2018-1000153 Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability
Attackers can exploit CSRF to trigger vSphere actions causing denial of service or exfiltrate stored credentials to attacker-controlled servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000153?
CVE-2018-1000153 is a high-severity vulnerability in n/a, published on 5 Apr 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").
Weakness: CWE-352
Which versions are affected by CVE-2018-1000153?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:vsphere-cloud. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:vsphere-cloud Maven | All versions | 2.17 |
org.jenkins-ci.plugins:vsphere-cloud Maven | All versions | 2.17 |
Products include Jenkins Vsphere.
How do I fix CVE-2018-1000153?
Upgrade org.jenkins-ci.plugins:vsphere-cloud to 2.17 or later.
Is CVE-2018-1000153 being exploited?
There is no known exploitation of CVE-2018-1000153 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2g32-2j8w-2qgf.