CVE-2019-10307: Jenkins Static Analysis Utilities Plugin Cross-site Request Forgery Vulnerability
Summary
CVE-2019-10307: Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability. Affects org.jvnet.hudson.plugins:analysis-core versions < 1.96. Fixed in 1.96. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins Static Analysis Utilities Plugin is a plugin for the Jenkins automation server that provides utilities for analyzing static code analysis results. It allows other plugins to display trend graphs for their static analysis results. The analysis-core Plugin, which is part of the Jenkins Static Analysis Utilities Plugin, provides the configuration form for the default settings of each graph.
Vulnerability Detail
The Jenkins analysis-core Plugin did not perform a permission check in its configuration form and form submission handler, allowing attackers with Job/Read access to change the per-job graph configuration defaults for all users. Additionally, the form submission handler did not require POST requests, resulting in a cross-site request forgery vulnerability. This vulnerability could be exploited by an attacker to modify the graph configuration defaults and potentially manipulate the displayed trend graphs.
How To Fix
Latest published version: 1.13 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.96
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the Jenkins analysis-core Plugin to the latest version as soon as possible.
Conclusion
The Jenkins Static Analysis Utilities Plugin is vulnerable to a cross-site request forgery vulnerability in its analysis-core Plugin. This vulnerability allows attackers with Job/Read access to modify the per-job graph configuration defaults for all users. It is recommended to update the plugin to version 1.96 or later to fix this vulnerability. There are no known workarounds, and it is important to take action to prevent potential exploitation. For further support, please contact DevNack.com.
See every vulnerability recorded for org.jvnet.hudson.plugins:analysis-core →
FAQ
This vulnerability allows attackers with Job/Read access to modify the per-job graph configuration defaults for all users. They can potentially manipulate the displayed trend graphs, leading to inaccurate or misleading information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply enter your Jenkins URL and the playground will analyze your pom.xml file to identify any vulnerable dependencies.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
There are no known public exploits for this vulnerability at the time of this report. However, it is still important to update the affected plugin to prevent potential exploitation.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jvnet.hudson.plugins:analysis-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
