CVE-2019-1003008
published 2019-02-06CVE-2019-1003008: A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in…
PriorityP338high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.15%
66.7th percentile
A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | active_directory_plugin | — | — |
| jenkins | blue_ocean_plugin | — | — |
| jenkins | config_file_provider_plugin | — | — |
| jenkins | from_job_import_plugin | — | — |
| jenkins | git_plugin | — | — |
| jenkins | github_authentication_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | jenkins_startup_or_after_monitoring_plugin | — | — |
| jenkins | job_import_plugin | — | — |
| jenkins | kanboard_plugin | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | openid_connect_authentication_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | token_macro_plugin | — | — |
| jenkins | warnings_next_generation | <= 2.1.1 | — |
| jenkins | warnings_next_generation_plugin | — | — |
| jenkins | warnings_plugin | — | — |
| jenkins | xml_parser_used_in_job_import_plugin | — | — |
| jenkins_project | jenkins_warnings_next_generation_plugin | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
ghsa·2022-05-13
CVE-2019-1003008 [HIGH] CWE-352 Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
Jenkins Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to cross-site request forgery (CSRF). This allowed attackers to execute arbitrary code on the Jenkins controller by applying AST transforming annotations such as `@Grab` to source code elements.
The affected HTTP endpoint now applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations. Additionally, the form validation HTTP endpoint now requires that requests be sent via POST to p
OSV
Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
osv·2022-05-13
CVE-2019-1003008 [HIGH] Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
Jenkins Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to cross-site request forgery (CSRF). This allowed attackers to execute arbitrary code on the Jenkins controller by applying AST transforming annotations such as `@Grab` to source code elements.
The affected HTTP endpoint now applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations. Additionally, the form validation HTTP endpoint now requires that requests be sent via POST to p
Jenkins
Jenkins Security Advisory 2019-01-28
vendor_jenkins·2019-01-28·CVSS 8.8
CVE-2019-1003005 [HIGH] Jenkins Security Advisory 2019-01-28
Title: Jenkins Security Advisory 2019-01-28
Jenkins Security Advisory 2019-01-28
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Active Directory
Plugin
Blue Ocean
Plugin
Config File Provider
Plugin
Git
Plugin
GitHub Authentication
Plugin
Groovy
Plugin
Job Import
Plugin
Job Import
Plugin
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-02-06
Published