Lucene search

JenkinsCVE-2019-1003008

HistoryFeb 06, 2019 - 4:29 p.m.

CVE-2019-1003008

2019-02-0616:29:00

CWE-352

jenkins

web.nvd.nist.gov

cve-2019-1003008

cross-site request forgery

jenkins

warnings next generation plugin

arbitrary code execution

security vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

41.5%

JSON

A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.

Affected configurations

Nvd

Node

jenkinswarnings_next_generationRange≤2.1.1jenkins

VendorProductVersionCPE
jenkinswarnings_next_generation*cpe:2.3:a:jenkins:warnings_next_generation:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	warnings_next_generation	*	cpe:2.3:a:jenkins:warnings_next_generation::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Warnings Next Generation Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "2.1.1 and earlier"
      }
    ]
  }
]

References

jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20%282%29

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

41.5%

JSON

Related for CVE-2019-1003008