CVE-2019-1003044

CVSS v3.0 7.1 (High)

CVSS v2.0 2.1 (Low)

EPSS 0.27 % (66^th)

Affected Products 1

Advisories 1

A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Weaknesses

CWE-352: Cross-Site Request Forgery (CSRF)

CVE Status: PUBLISHED
CNA: Jenkins Project
Published Date: 2019-03-28 18:29:00
(5 years ago)
Updated Date: 2023-10-25 18:16:04
(10 months ago)

Affected Products

Jenkins

Slack Notification

Configuration #1

		CPE23	From	Up To
	Jenkins Slack Notification for Jenkins 2.19 and prior versions	cpe:2.3:a:jenkins:slack_notification::::::jenkins		<= 2.19