CVE-2019-10331: CSRF
A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.
Other sources
A missing permission check in a form validation method in CloudBees CD Plugin allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password.
Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10331?
CVE-2019-10331 is a cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration as Code Plugin.
What is the severity of CVE-2019-10331?
The severity of CVE-2019-10331 is medium with a CVSS v3.0 base score of 4.3.
How does CVE-2019-10331 affect Jenkins ElectricFlow Plugin?
CVE-2019-10331 affects Jenkins ElectricFlow Plugin version 1.1.5 and earlier in Configuration as Code Plugin.
How can I fix CVE-2019-10331?
To fix CVE-2019-10331, update Jenkins ElectricFlow Plugin to version 1.1.7 or later.
Where can I find more information about CVE-2019-10331?
You can find more information about CVE-2019-10331 on the Openwall, SecurityFocus, and Jenkins websites.