CVE-2019-10324: Cross-Site Request Forgery (CSRF)

May 24, 2022 (updated January 30, 2024)

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.

References

www.openwall.com/lists/oss-security/2019/05/31/2
www.securityfocus.com/bid/108540
github.com/advisories/GHSA-mqj3-fc39-73fj
github.com/jenkinsci/artifactory-plugin/commit/687cc2b4e9ad62c0bdcee4afc9e8e90c5089ee58
jenkins.io/security/advisory/2019-05-31/
nvd.nist.gov/vuln/detail/CVE-2019-10324

Code Behaviors & Features

Detect and mitigate CVE-2019-10324 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →