jenkinsci/selenium-plugin · Security
Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection
- GHSA ID
- GHSA-rp4x-xpgf-4xv7
- CVE ID
- CVE-2020-2196
- Severity
- high
- Published
- Updated
- CVSS
- 7.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 7.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Description
Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints.
This allows attackers to perform the following actions:
- Restart the Selenium Grid hub.
- Delete or replace the plugin configuration.
- Start, stop, or restart Selenium configurations on specific nodes.
Through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller.
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)