TI-2019-07633 Aliases CVE-2019-10324 GHSA-mqj3-fc39-73fj

Cross-site request forgery in Jenkins Artifactory Plugin

LOW 30CWE-352Published 2019-05-31 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.

Why it matters now

EPSS 0.00751 55th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:artifactory (Maven): 3.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Artifactory Plugin	up to 3.2.2	—	No fix listed	CNA
—	org.jenkins-ci.plugins:artifactory (Maven)	before 3.2.3	3.2.3	Patch available	GHSA-mqj3-fc39-73fj

Jenkins Artifactory Plugin VendorJenkins Affected up to 3.2.2 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:artifactory (Maven) Vendor— Affected before 3.2.3 Fixed in 3.2.3 Patch available GHSA-mqj3-fc39-73fj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jfrog:artifactory::::::jenkins::*	up to 3.2.2	Vulnerable	JFrog

cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:jenkins:*:* Versions up to 3.2.2 Vulnerable ·JFrog

Remediation

Fix · GHSA-mqj3-fc39-73fj org.jenkins-ci.plugins:artifactory (Maven) Fixed in 3.2.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-10324
2026-10-03 Alias added: GHSA-mqj3-fc39-73fj

References

Advisory 2

Other 2

TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5

See all 1914 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences