CVE-2019-1003012
published 2019-02-06CVE-2019-1003012: A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js…
medium6.5CVSS 3.0
AVNACLPRNUIRSUCNIHAN
A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | active_directory_plugin | — | — |
| jenkins | blue_ocean | <= 1.10.1 | — |
| jenkins | blue_ocean_plugin | — | — |
| jenkins | config_file_provider_plugin | — | — |
| jenkins | from_job_import_plugin | — | — |
| jenkins | git_plugin | — | — |
| jenkins | github_authentication_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | jenkins_startup_or_after_monitoring_plugin | — | — |
| jenkins | job_import_plugin | — | — |
| jenkins | kanboard_plugin | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | openid_connect_authentication_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | token_macro_plugin | — | — |
| jenkins | warnings_next_generation_plugin | — | — |
| jenkins | warnings_plugin | — | — |
| jenkins | xml_parser_used_in_job_import_plugin | — | — |
| jenkins_project | jenkins_blue_ocean_plugins | — | — |
| redhat | openshift_container_platform | — | — |