CVE-2023-32989 Jenkins Azure VM Agents Plugin Cross-site Request Forgery vulnerability

What is CVE-2023-32989?

CVE-2023-32989 is a high-severity vulnerability in Jenkins Azure VM Agents Plugin, published on 16 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.

Weakness: CWE-352

Which versions are affected by CVE-2023-32989?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:azure-vm-agents. It affects 1 product.

Products include Jenkins Azure Vm Agents.

How do I fix CVE-2023-32989?

Upgrade org.jenkins-ci.plugins:azure-vm-agents to 853.v4a or later.

Is CVE-2023-32989 being exploited?

There is no known exploitation of CVE-2023-32989 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Azure VM Agents Plugin

• CVE-2023-32990 Jenkins Azure VM Agents Plugin missing permission checks Medium 6.5
• CVE-2019-1003037 Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin Medium 6.5
• CVE-2023-32988 Jenkins Azure VM Agents Plugin missing permission checks Medium 4.3
• CVE-2019-1003035 Information disclosure in Azure VM Agents Plugin Medium 4.3
• CVE-2019-1003036 Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-26j3-4m55-j6r7.