CVE-2018-1000412 Jenkins Jira Plugin Incorrect Authorization vulnerability

What is CVE-2018-1000412?

CVE-2018-1000412 is a high-severity missing authorization vulnerability in n/a, published on 9 Jan 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Weakness: CWE-863

Which versions are affected by CVE-2018-1000412?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:jira. It affects 1 product.

Products include Jenkins Jira.

How do I fix CVE-2018-1000412?

Upgrade org.jenkins-ci.plugins:jira to 3.0.2 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-1000412 being exploited?

There is no known exploitation of CVE-2018-1000412 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-16541 Jenkins JIRA Plugin allows users to select and use credentials with System scope Critical 9.9
• CVE-2023-49653 Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials Medium 6.5
• CVE-2022-29041 Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fpg6-xqj4-j7wf.