Jenkins JUnit Plugin CSRF vulnerability

MEDIUM 6.5CVE-2018-1000411 · GHSA-x9gm-m8pp-54vx · Published 09/01/2019 · updated 17/06/2026

In short

CVE-2018-1000411 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:junit, junit (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.81%, higher than 56.9% of all vulnerabilities.
Fix: update to 1.26 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:junit Maven	`< 1.26`	`1.26`
junit jenkins	`≤ 1.25`	No fix yet

Description

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

NVD description

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

References

nvd.nist.gov/vuln/detail/CVE-2018-1000411 · ADVISORY
jenkinsci/junit-plugin commit 091ee0d · WEB
jenkinsci/junit-plugin · WEB
jenkins.io/security/advisory/2018-09-25 · WEB
web.archive.org/web/20200227092927/http://www.securityfocus.com/bid/106532 · WEB
securityfocus.com/bid/106532 · Third Party Advisory

More vulnerabilities in org.jenkins-ci.plugins:junit

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:junit

Maven

< 1.26

1.26

junit

jenkins

≤ 1.25

No fix yet

Description

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

NVD description

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

More vulnerabilities in org.jenkins-ci.plugins:junit

See all →