Bug 1565689 (CVE-2017-1000244)

Summary:	CVE-2017-1000244 jenkins-plugin-favorite: CSRF vulnerability in Favorite Plugin allows changing another user’s favorites
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dedgar, jgoulding, jokerman, mchappel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jenkins-favorite-plugin 2.3.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 20:00:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1565803
Bug Blocks:	1565691

Description Andrej Nemec 2018-04-10 14:35:35 UTC

An API used to add and remove a favorite was vulnerable to CSRF, allowing attackers to change the victim’s favorites.

The API now requires requests to be sent via POST, which is subject to the CSRF protection configurable in Jenkins global security configuration.

External References:

https://jenkins.io/security/advisory/2017-06-06/

Upstream patch:

https://github.com/jenkinsci/favorite-plugin/commit/e51869213ba4f197724f4278a771c635a95e5f47