CVE-2019-16550 - A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents

Back Back to CVE browser

HIGH

A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents

Published Dec 17, 2019

8.8

HIGH

CVSS 3.1

EPSS 0.64%

Description

A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.

Affected products

Vendor Jenkins project Product Jenkins Maven Release Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 0.16.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins Maven Release Plugin	unknown	Affected ≥ unspecified, ≤ 0.16.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (6)

http://www.openwall.com/lists/oss-security/2019/12/17/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3866
Advisory
https://github.com/advisories/GHSA-g2x8-xw86-vpq3
Advisory
https://github.com/jenkinsci/m2release-plugin/commit/1e4d6fee2eab16e7a396b6d3d5f10a87e5c29cc2
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16550

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/12/17/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3866		Advisory
https://github.com/advisories/GHSA-g2x8-xw86-vpq3		Advisory
https://github.com/jenkinsci/m2release-plugin/commit/1e4d6fee2eab16e7a396b6d3d5f10a87e5c29cc2
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16550