Cross-Site Request Forgery in Jenkins Maven Release Plugin by Jenkins
CVE-2019-16550

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Maven Release Plugin
Vendor
CVE Published:
17 December 2019

Summary

A cross-site request forgery vulnerability exists in the connection test form of the Jenkins Maven Release Plugin v0.16.1 and prior. This flaw allows attackers to trick Jenkins into establishing connections to attacker-specified web servers. If exploited, the vulnerability can potentially enable unauthorized parsing of XML documents, compromising the integrity of Jenkins installations.

Affected Version(s)

Jenkins Maven Release Plugin <= 0.16.1

References

https://jenkins.io/security/advisory/2019-12-17/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/12/17/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.