PT-2019-11725 · Jenkins · Jenkins Artifactory Plugin

Oleg Nenashev · Published 2019-05-31 · Updated 2023-10-25 · CVE-2019-10324

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Artifactory Plugin versions 3.2.2 and earlier

Description A cross-site request forgery issue allows attackers to perform certain actions, including scheduling a release build, performing release staging for Gradle and Maven projects, and promoting previously staged builds. This is possible due to vulnerabilities in the ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit functions.

Recommendations For Jenkins Artifactory Plugin versions 3.2.2 and earlier, consider disabling the ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit functions as a temporary workaround until a patch is available. Restrict access to these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-10324

GHSA-MQJ3-FC39-73FJ

Affected Products

Jenkins Artifactory Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-mqj3-fc39-73fj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10324 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10324 · Security Note
• https://github.com/jenkinsci/artifactory-plugin/commit/687cc2b4e9ad62c0bdcee4afc9e8e90c5089ee58 · Note
• http://openwall.com/lists/oss-security/2019/05/31/2 · Note
• http://securityfocus.com/bid/108540 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10324 · Note