CVE-2018-1000014
Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.83% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- jenkins/translation assistance
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/102809Third Party Advisory, VDB Entry
- https://jenkins.io/security/advisory/2018-01-22/Vendor Advisory
- http://www.securityfocus.com/bid/102809Third Party Advisory, VDB Entry
- https://jenkins.io/security/advisory/2018-01-22/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.