PT-2019-11310 · Jenkins · Jenkins Blue Ocean Plugin+1

Wadeck Follonier · Published 2019-02-06 · Updated 2023-10-25 · CVE-2019-1003012

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Blue Ocean Plugins versions 1.10.1 and earlier

Description: A data modification issue exists that allows attackers to bypass all cross-site request forgery protection in the Blue Ocean API. The vulnerability is found in several files, including blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, and blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly.

Recommendations: As a temporary workaround, consider disabling the affected API endpoints until a patch is available. Restrict access to the vulnerable files to minimize the risk of exploitation. Avoid using the vulnerable functions in the affected files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-1003012

GHSA-QXH5-5R5P-5GVF

Affected Products

Jenkins

Jenkins Blue Ocean Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-1003012 · Security Note
• https://osv.dev/vulnerability/GHSA-qxh5-5r5p-5gvf · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0327 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1003012 · Vendor Advisory
• https://github.com/jenkinsci/blueocean-plugin/commit/1a03020b5a50c1e3f47d4b0902ec7fc78d3c86ce · Note