GitHub Advisoryadvisory · Maven

GHSA-qxh5-5r5p-5gvf Cross-Site Request Forgery in Jenkins Blue Ocean Plugin

MEDIUM Published 2022-05-13 Modified 2022-11-01 Official page ↗
Aliases
CVE-2019-1003012
Ecosystem
Maven
Packages
io.jenkins.blueocean:blueocean
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2022-11-01

Affected packages

• Maven io.jenkins.blueocean:blueocean: < 1.10.2 → fixed in 1.10.2

Description

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API. The vulnerability is found in: • blueocean-core-js/src/js/bundleStartup.js • blueocean-core-js/src/js/fetch.ts • blueocean-core-js/src/js/i18n/i18n.js • blueocean-core-js/src/js/urlconfig.js • blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java • blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java • blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly

Related

Alias · CVE (1)

  • CVE-2019-1003012 A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js,… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References