Medium · 4.3 CVE-2019-10408 EUVD-2022-5760GHSA-xc7q-p3f4-q389

Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery

Published Sep 25, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Project Inheritance Plugin Package: hudson.plugins:project-inheritance Category: Web / CMS Ecosystem: Maven

Description

A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templates.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Project Inheritance Plugin	2.0.0 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	hudson.plugins:project-inheritance	< 19.08.2	19.08.2	GHSA-xc7q-p3f4-q389

References

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-401
[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list