CVE-2019-16565: CSRF
A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Other sources
Jenkins Team Concert Plugin 1.3.0 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16565?
CVE-2019-16565 is classified as a medium severity vulnerability.
How do I fix CVE-2019-16565?
To fix CVE-2019-16565, update the Jenkins Team Concert Plugin to version 1.4.0 or later.
Who is affected by CVE-2019-16565?
CVE-2019-16565 affects users of Jenkins Team Concert Plugin version 1.3.0 and earlier.
What type of vulnerability is CVE-2019-16565?
CVE-2019-16565 is a cross-site request forgery (CSRF) vulnerability.
What does CVE-2019-16565 allow attackers to do?
CVE-2019-16565 allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs.