CVE-2019-10289

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Netsparker Cloud Scan Plugin	1.1.5 and older

References

http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1032Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1032Vendor Advisory

Timeline

Published: Apr 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10295.9A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability could cause Skype f CVE-2019-102906.5A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form va CVE-2019-102918.8Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master w CVE-2019-102926.5A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attack CVE-2019-102936.5A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall CVE-2019-102948.8Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte CVE-2019-102958.8Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by use CVE-2019-102968.8Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vie CVE-2019-102978.8Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us CVE-2019-102988.8Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users CVE-2019-102998.8Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be CVE-2019-10304.3An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who