CVE-2019-10359: Jenkins Maven Release Plugin Cross-Site Request Forgery
Summary
CVE-2019-10359: Jenkins Maven Release Plugin contains Cross-Site Request Forgery vulnerability. Affects org.jenkins-ci.plugins.m2release:m2release versions < 0.15.0. Fixed in 0.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Maven Release Plugin is a plugin for the Jenkins automation server that allows users to perform Maven releases. It integrates with the Maven build system to automate the release process, including versioning, tagging, and deployment. The plugin provides a user interface for configuring release options and initiating releases. However, prior to version 0.15.0, the plugin was vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins Maven Release Plugin (prior to version 0.15.0) allowed attackers to perform releases with attacker-specified options. This means that an attacker could trick a user with sufficient privileges to unknowingly initiate a release with malicious options. The vulnerability originated in the M2ReleaseAction#doSubmit method, which did not properly validate the source of the request. As a result, an attacker could craft a malicious request that would be executed by the plugin, potentially leading to unauthorized releases or other malicious actions.
How To Fix
Minimum fixed version
0.15.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Jenkins Maven Release Plugin prior to version 0.15.0 is vulnerable to a cross-site request forgery (CSRF) attack, which could allow attackers to perform unauthorized releases with attacker-specified options. To mitigate this vulnerability, users should upgrade to version 0.15.0 or later of the plugin. There are no known workarounds for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.m2release:m2release →
FAQ
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the case of the Jenkins Maven Release Plugin, it means that an attacker can perform unauthorized releases by tricking a user with sufficient privileges to initiate a release with attacker-specified options.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, including the Jenkins Maven Release Plugin vulnerability.
There are no known public exploits of this vulnerability at the time of this report. However, it is important to upgrade to the fixed version of the plugin to prevent potential unauthorized releases or other malicious actions.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the plugin as soon as possible.
You can find more information about the fixed version of the Jenkins Maven Release Plugin on the official Jenkins website or the plugin's GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.m2release:m2release.
