CVE-2018-1999032 Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks
MediumCVSS 6.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/pangolin-testrail-connector(Maven) | < 2.2 | 2.2 |
| org.jenkins-ci.plugins/pangolin-testrail-connector(Maven) | = 2.1 | No fix listed |
| org.jenkins-ci.plugins/pangolin-testrail-connector(Maven) | <= 2.1 | No fix listed |
| agiletestware pangolin connector for testrail | <= 2.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- jenkins.io third-party-advisory
- github.com