CVE-2019-1003010: CSRF
A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:gitto a version that resolves this vulnerability.Fixed in 3.9.2 - Upgrade
Upgrade
azurelinux/gitto a version that resolves this vulnerability.Fixed in 2.23.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003010?
CVE-2019-1003010 is considered a medium severity cross-site request forgery vulnerability.
How do I fix CVE-2019-1003010?
To fix CVE-2019-1003010, upgrade the Jenkins Git Plugin to version 3.9.2 or later.
Which versions are affected by CVE-2019-1003010?
CVE-2019-1003010 affects Jenkins Git Plugin versions 3.9.1 and earlier.
What type of attack does CVE-2019-1003010 facilitate?
CVE-2019-1003010 facilitates an attack that allows unauthorized creation of Git tags in a Jenkins workspace.
Is Jenkins Git Plugin the only affected software by CVE-2019-1003010?
While Jenkins Git Plugin is the primary affected software, Red Hat OpenShift Container Platform version 3.11 is also impacted.