CVE-2019-10409 Missing permission check in Jenkins Project Inheritance Plugin

Medium 4.3 Published 25 Sep 2019 Updated 4 Aug 2024

Attackers with read access can generate projects from templates due to missing permission checks in the Jenkins Project Inheritance Plugin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10409?

CVE-2019-10409 is a medium-severity missing authorization vulnerability in Jenkins Project Inheritance Plugin, published on 25 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates.

Weakness: CWE-862

Which versions are affected by CVE-2019-10409?

2 open source packages ship an affected version, including hudson.plugins:project-inheritance. It affects 1 product.

Package	Affected	Fixed in
`hudson.plugins:project-inheritance` Maven	All versions	`19.08.02`
`hudson.plugins:project-inheritance` Maven	All versions	`19.08.02`

Products include Jenkins Project Inheritance.

How do I fix CVE-2019-10409?

Upgrade hudson.plugins:project-inheritance to 19.08.02 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-10409 being exploited?

There is no known exploitation of CVE-2019-10409 in the wild and no public exploit code.

Sources

Also known as GHSA-gpmw-h4wq-4rch.