VDB

CVE-2019-1003012

CVE-2019-1003012 PUBLISHED CVSS 4.300000190734863 MEDIUM

Reported by jenkins · Published February 6, 2019

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.

Risk Scores

CVSS 2.0
4.300000190734863

Affected Products

VendorProductVersions
Jenkins projectJenkins Blue Ocean Plugins1.10.1 and earlier
Jenkins projectJenkins Blue Ocean Plugins*, *, 1.10.1 and earlier
Mavenio.jenkins.blueocean:blueocean0, 0

Timeline

  • Feb 6, 2019 CVE Published
  • Oct 9, 2019 CVE Updated
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Dec 29, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 3, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 5, 2022 EPSS Score
  • Sep 9, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›