Skip to content
OpenAdvisories
Medium · 6.5 CVE-2019-1003012 EUVD-2022-5060GHSA-qxh5-5r5p-5gvf

Cross-Site Request Forgery in Jenkins Blue Ocean Plugin

Published Feb 6, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Blue Ocean Plugins Package: io.jenkins.blueocean:blueocean Category: Web / CMS Ecosystem: Maven

Description

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Blue Ocean Plugins 1.10.1 and earlier —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.82-1.git.1673.133961e.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift +12 3.11.82-1.git.0.08bc31b.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.82-1.git.0.efb6af0.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.82-1.git.300.89765c9.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.82-1.git.452.0ce6383.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.82-1.git.52.2fdca3f.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.82-1.git.254.a448936.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.82-1.git.14.e353758.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-web-console 3.11.82-1.git.355.5e8b1d9.el7 RHBA-2019:0326
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.82-1.git.425.7cac034.el7 RHBA-2019:0326
Red Hat OpenShift 3 haproxy +1 1.8.17-3.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins 2.150.2.1549032159-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1549642489-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-ansible +4 3.11.82-3.git.0.9718d0a.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.82-1.git.219.0b5aff4.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.82-1.git.380.cf11c51.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus +1 3.11.82-1.git.5027.9d24833.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.82-1.git.0.3bf41ce.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.82-1.git.1063.48444e8.el7 RHBA-2019:0326

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.jenkins.blueocean:blueocean < 1.10.2 1.10.2 GHSA-qxh5-5r5p-5gvf

Advisories 1

References