CVE-2019-1003012

Опубликовано: 06 фев. 2019

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.

Ссылки

https://access.redhat.com/errata/RHBA-2019:0326
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Third Party Advisory
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201
Vendor Advisory
https://access.redhat.com/errata/RHBA-2019:0326
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Third Party Advisory
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:blue_ocean:*:*:*:*:*:jenkins:*:*

Версия до 1.10.1 (включая)

Конфигурация 2

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

EPSS

Процентиль: 36%

0.00154

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2019-1003012

CVSS3: 7.3

redhat

около 7 лет назад

GHSA-qxh5-5r5p-5gvf