CVE-2018-1000014 - Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator

Back Back to CVE browser

HIGH

Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator

Published Jan 23, 2018

8.8

HIGH

CVSS 3.0

EPSS 0.83%

Description

Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (4)

http://www.securityfocus.com/bid/102809
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-pwvj-6phx-qv8c
Advisory
https://jenkins.io/security/advisory/2018-01-22/
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000014

Link	Providers	Tags
http://www.securityfocus.com/bid/102809		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-pwvj-6phx-qv8c		Advisory
https://jenkins.io/security/advisory/2018-01-22/		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000014