CVE-2019-1003017: Cross-Site Request Forgery (CSRF)

May 13, 2022 (updated January 9, 2024)

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job’s configuration.

References

github.com/advisories/GHSA-8crr-xf35-5f5p
github.com/jenkinsci/job-import-plugin/commit/8f826a684ba0969697d2a92a6f448aef8f03b66c
jenkins.io/security/advisory/2019-01-28/
nvd.nist.gov/vuln/detail/CVE-2019-1003017

Code Behaviors & Features

Detect and mitigate CVE-2019-1003017 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →