CVE-2018-1000414 CSRF vulnerability in Config File Provider Plugin

High 8.1 Published 9 Jan 2019 Updated 5 Aug 2024

Attackers can trick users into creating or editing configuration file definitions in the Jenkins Config File Provider Plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-1000414?

CVE-2018-1000414 is a high-severity vulnerability in n/a, published on 9 Jan 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.

Weakness: CWE-352

Which versions are affected by CVE-2018-1000414?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:config-file-provider. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:config-file-provider` Maven	All versions	`3.2`
`org.jenkins-ci.plugins:config-file-provider` Maven	All versions	`3.2`

Products include Jenkins Config File Provider.

How do I fix CVE-2018-1000414?

Upgrade org.jenkins-ci.plugins:config-file-provider to 3.2 or later.

Is CVE-2018-1000414 being exploited?

There is no known exploitation of CVE-2018-1000414 in the wild and no public exploit code.

Sources

Also known as GHSA-r5m8-5mwx-cmj8.