PT-2019-11315 · Jenkins · Jenkins Job Import Plugin+1

Daniel Beck · Published 2019-02-06 · Updated 2023-10-25 · CVE-2019-1003017

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 3.0 and earlier

Description: A data modification issue exists that allows attackers to copy jobs from another Jenkins instance, potentially installing additional plugins to load the imported job's configuration.

Recommendations: For Jenkins Job Import Plugin versions 3.0 and earlier, update to a version later than 3.0 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-1003017

GHSA-8CRR-XF35-5F5P

Affected Products

Jenkins

Jenkins Job Import Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-1003017 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1003017 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8crr-xf35-5f5p · Vendor Advisory
• https://github.com/jenkinsci/job-import-plugin · Note
• https://github.com/jenkinsci/job-import-plugin/commit/8f826a684ba0969697d2a92a6f448aef8f03b66c · Note