TI-2019-15857 Aliases CVE-2019-1003012 GHSA-qxh5-5r5p-5gvf

Cross-site request forgery in Jenkins Blue Ocean Plugins

LOW 31CWE-352Published 2019-02-06 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 fixed, 7 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.

Why it matters now

EPSS 0.01108 66th percentileScored 2026-11-07

Fix Partial io.jenkins.blueocean:blueocean (Maven): 1.10.2Red Hat: 1 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Blue Ocean Plugins	up to 1.10.1	—	No fix listed	CNA
—	io.jenkins.blueocean:blueocean (Maven)	before 1.10.2	1.10.2	Patch available	GHSA-qxh5-5r5p-5gvf

Jenkins Blue Ocean Plugins VendorJenkins Affected up to 1.10.1 Fixed in — No fix listed CNA
io.jenkins.blueocean:blueocean (Maven) Vendor— Affected before 1.10.2 Fixed in 1.10.2 Patch available GHSA-qxh5-5r5p-5gvf

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:blue_ocean::::::jenkins::*	up to 1.10.1	Vulnerable	Jenkins
cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*	3.11	Vulnerable	Red Hat

cpe:2.3:a:jenkins:blue_ocean:*:*:*:*:*:jenkins:*:* Versions up to 1.10.1 Vulnerable ·Jenkins
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat

Remediation

Fix · GHSA-qxh5-5r5p-5gvf io.jenkins.blueocean:blueocean (Maven) Fixed in 1.10.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 3.10	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.4	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.5	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.6	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.7	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.9	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet
Red Hat OpenShift Container Platform 3.11	Fixed	—

Timeline

2026-10-02 Threatist record created from CVE-2019-1003012
2026-10-03 Alias added: GHSA-qxh5-5r5p-5gvf

References

Advisory 4

Other 1

https://github.com/jenkinsci/blueocean-plugin/commit/1a03020b5a50c1e3f47d4b0902ec7fc78d3c86ce

TI-2023-21170 Cross-site request forgery in Jenkins Blue Ocean Plugin CVSS 3.1HIGH 8.8
TI-2017-14443 Blue Ocean allows the creation of GitHub organization folders that are set up to scan a… CVSS 3.0HIGH 8.5
TI-2020-02131 Path traversal in Jenkins Blue Ocean Plugin CVSS 3.1MEDIUM 6.5
TI-2022-13010 Missing authorization in Jenkins Blue Ocean Plugin CVSS 3.1MEDIUM 6.5
TI-2022-13008 Insufficiently protected credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin CVSS 3.1MEDIUM 6.5
TI-2022-13009 Cross-site request forgery in Jenkins Blue Ocean Plugin CVSS 3.1MEDIUM 6.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences