CVE-2019-10368 - A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins

Back Back to CVE browser

HIGH

A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins

Published Aug 7, 2019

8.8

HIGH

CVSS 3.0

EPSS 0.80%

Description

A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products

Vendor Jenkins project Product Jenkins JClouds Plugin Default
n/a
- Version
  2.14 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins JClouds Plugin

n/a

Version	Status	Constraints
2.14 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (7)

http://www.openwall.com/lists/oss-security/2019/08/07/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-87hx-q65g-r35x
Advisory
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482
x_refsource_CONFIRMVendor Advisory
https://lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac%40%3Cnotifications.jclouds.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45%40%3Cnotifications.jclouds.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881%40%3Cnotifications.jclouds.apache.org%3E
mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2019-10368

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/08/07/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-87hx-q65g-r35x		Advisory
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482		x_refsource_CONFIRMVendor Advisory
https://lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac%40%3Cnotifications.jclouds.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45%40%3Cnotifications.jclouds.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881%40%3Cnotifications.jclouds.apache.org%3E		mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2019-10368

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner jenkins

Published Aug 7, 2019

Updated Aug 4, 2024

Reserved Mar 29, 2019

Link CVE-2019-10368

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-10368

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-10368

GHSA-87HX-Q65G-R35X