CVE-2019-1003012 Cross-Site Request Forgery in Jenkins Blue Ocean Plugin

Medium 6.5 Published 6 Feb 2019 Updated 5 Aug 2024

Attackers can bypass CSRF protection in the Jenkins Blue Ocean API, allowing unauthorized state-changing requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-1003012?

CVE-2019-1003012 is a medium-severity vulnerability in Redhat Openshift Container Platform, published on 6 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.

Weakness: CWE-352

Which versions are affected by CVE-2019-1003012?

2 open source packages ship an affected version, including io.jenkins.blueocean:blueocean. It affects 2 products.

Package	Affected	Fixed in
`io.jenkins.blueocean:blueocean` Maven	All versions	`1.10.2`
`io.jenkins.blueocean:blueocean` Maven	All versions	`1.10.2`

Products include Jenkins Blue Ocean, Redhat Openshift Container Platform.

How do I fix CVE-2019-1003012?

Upgrade io.jenkins.blueocean:blueocean to 1.10.2 or later.

Is CVE-2019-1003012 being exploited?

There is no known exploitation of CVE-2019-1003012 in the wild and no public exploit code.

All Redhat Openshift Container Platform vulnerabilities

Sources

Also known as GHSA-qxh5-5r5p-5gvf.