CVE-2019-10462: Jenkins Dynatrace Plugin Cross-Site Request Forgery
Summary
CVE-2019-10462: Jenkins Dynatrace Plugin vulnerable to Cross-Site Request Forgery. Affects org.jenkins-ci.plugins:dynatrace-dashboard versions < 2.1.4. Fixed in 2.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Dynatrace Plugin is a deprecated plugin that integrates Dynatrace Application Monitoring into Jenkins. It allows users to monitor and analyze the performance of their applications during the build and deployment process. The plugin provides various features such as dashboards, charts, and reports to visualize the monitoring data. However, prior to version 2.1.4, the plugin is vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins Dynatrace Plugin allows attackers to perform CSRF attacks by tricking authenticated users into executing unwanted actions on their behalf. By exploiting this vulnerability, an attacker can connect to a URL of their choice using credentials they specify. This can lead to unauthorized access, data manipulation, or other malicious activities. It is important to note that this plugin is marked as deprecated, indicating that it is no longer actively maintained or supported.
How To Fix
Latest published version: 2.1.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by disabling or removing the Jenkins Dynatrace Plugin if it is not actively used. This can help eliminate the potential attack surface and reduce the risk of CSRF attacks.
Conclusion
The Jenkins Dynatrace Plugin prior to version 2.1.4 is vulnerable to a CSRF attack, which can lead to unauthorized access and potential data manipulation. It is crucial to update the plugin to the latest version to mitigate this vulnerability. If the plugin is not actively used, it is recommended to disable or remove it from the Jenkins installation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:dynatrace-dashboard →
FAQ
A CSRF attack, or Cross-Site Request Forgery attack, is a type of security vulnerability that allows an attacker to trick authenticated users into performing unwanted actions on a web application. By exploiting the trust between the user's browser and the target application, the attacker can execute actions on behalf of the user without their consent.
The CSRF vulnerability in the Jenkins Dynatrace Plugin can lead to unauthorized access to sensitive information, data manipulation, or other malicious activities. An attacker could exploit this vulnerability to perform actions on behalf of authenticated users, potentially compromising the integrity and security of the Jenkins environment.
There is no specific information provided about known exploits for this vulnerability. However, it is important to address this vulnerability promptly by updating the plugin to the latest version to mitigate the risk of potential exploits.
As the Jenkins Dynatrace Plugin is marked as deprecated, it is recommended to explore alternative solutions or plugins for integrating Dynatrace Application Monitoring into Jenkins. Users can search for other plugins or tools that provide similar functionality and are actively maintained and supported.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can input your pom.xml file to check if the Jenkins Dynatrace Plugin version you are using is vulnerable.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:dynatrace-dashboard.
