CVE-2019-1003008 Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability

High 8.8 Published 6 Feb 2019 Updated 17 Sep 2024

Attackers can execute arbitrary code via CSRF in the Jenkins Warnings Next Generation Plugin, requiring plugin updates.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-1003008?

CVE-2019-1003008 is a high-severity vulnerability in Jenkins Warnings Next Generation Plugin, published on 6 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.

Weakness: CWE-352

Which versions are affected by CVE-2019-1003008?

2 open source packages ship an affected version, including io.jenkins.plugins:warnings-ng. It affects 1 product.

Package	Affected	Fixed in
`io.jenkins.plugins:warnings-ng` Maven	All versions to `2.1.1`	None
`io.jenkins.plugins:warnings-ng` Maven	All versions to `2.1.1`	None

Products include Jenkins Warnings Next Generation.

How do I fix CVE-2019-1003008?

No fix has been published for CVE-2019-1003008 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-1003008 being exploited?

There is no known exploitation of CVE-2019-1003008 in the wild and no public exploit code.

Sources

Also known as GHSA-whf8-3h58-2w9f.