Cross-Site Request Forgery in Jenkins Relution Enterprise Appstore Publisher Plugin
CVE-2019-10388

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Relution Enterprise Appstore Publisher Plugin
Vendor
CVE Published:
7 August 2019

Summary

A cross-site request forgery vulnerability in the Jenkins Relution Enterprise Appstore Publisher Plugin, version 1.24 and earlier, could allow attackers to trick Jenkins into initiating HTTP connections to malicious servers. This could lead to unauthorized actions being performed in the context of an authenticated user, exposing sensitive information and compromising the security of Jenkins installations. Users should ensure their plugins are updated to mitigate potential threats stemming from this vulnerability.

Affected Version(s)

Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier

References

http://www.openwall.com/lists/oss-security/2019/08/07/1
mailing-listx_refsource_MLIST
https://jenkins.io/security/advisory/2019-08-07/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.