GHSA-8crr-xf35-5f5p

Jenkins Job Import Plugin CSRF vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003017

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:job-import-plugin	< 3.1	3.1

Details

As written in the advisory (Markdown source, shown as plain text).

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-1003017 advisory
https://github.com/jenkinsci/job-import-plugin/commit/8f826a684ba0969697d2a92a6f448aef8f03b66c web
https://github.com/jenkinsci/job-import-plugin package
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302 web