CVE-2019-10300

HIGH

Jenkins GitLab Plugin < 1.5.11 - Cross-Site Request Forgery via Test Connection Form

Title source: llm

Description

A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/108045

Third Party Advisory x_refsource_misc

https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0788

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357

Scores

CVSS v3 8.0

EPSS 0.0008

EPSS Percentile 24.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (2)

jenkins/gitlab < 1.5.11

org.jenkins-ci.plugins/gitlab-plugin 0 - 1.5.12Maven

Published Apr 18, 2019

Tracked Since Feb 18, 2026