Not rated
CVE-2019-1003098 A cross-site request forgery vulnerability in Jenkins openid Plugin in the…
Description
A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins openid Plugin | Versions not published |
References
- 107790 www.securityfocus.com
- [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins www.openwall.com
- jenkins.io jenkins.io
Timeline
- Published
- Last modified
Other CVEs of Jenkins openid Plugin
The 5 CVEs of Jenkins openid Plugin →
CVE-2023-24444
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login
9.8
Critical
CVE-2023-24445
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing…
6.1
Medium
CVE-2023-24446
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick…
8.8
High
CVE-2019-1003099
A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form…
Not rated