Jenkins Slack Notification Plugin CSRF vulnerability and missing permission checks

HIGH 7.1CVE-2019-1003044 · GHSA-5r8q-9fwv-2gpr · Published 28/03/2019 · updated 17/06/2026

In short

CVE-2019-1003044 is a HIGH (CVSS 7.1) vulnerability affecting org.jenkins-ci.plugins:slack, slack notification (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.1% of all vulnerabilities.
Fix: update to 2.20 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:slack Maven	`< 2.20`	`2.20`
slack notification jenkins	`≤ 2.19`	No fix yet

Description

A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-1003044 · ADVISORY
jenkinsci/slack-plugin commit 0268bbe · WEB
jenkinsci/slack-plugin · PACKAGE
jenkins.io/security/advisory/2019-03-25 · WEB
openwall.com/lists/oss-security/2019/03/28/2 · WEB
securityfocus.com/bid/107628 · WEB

More vulnerabilities in org.jenkins-ci.plugins:slack

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:slack

Maven

< 2.20

2.20

slack notification

jenkins

≤ 2.19

No fix yet

Description

NVD description