CVE-2019-10454 — Cross-Site Request Forgery in Jenkins Rundeck

CWE-352 — Cross-Site Request Forgery5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

0.3%

top 51.33%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Rundeck Jenkins Project Jenkins Rundeck Plugin

Timeline

PublishedOct 16

Latest updateMay 24

Description

A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_rundeck_plugin3.6.5 and earlier

▶NVDjenkins/rundeck3.6.5

🔴Vulnerability Details

OSV

Jenkins Rundeck Plugin CSRF vulnerability↗2022-05-24

▶

GHSA

Jenkins Rundeck Plugin CSRF vulnerability↗2022-05-24

▶

CVEList

CVE-2019-10454: A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified↗2019-10-16

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2019-10-16↗2019-10-16

▶