Jenkins Slack Notification Plugin CSRF vulnerability and missing permission checks

HOCH 7.1CVE-2019-1003044 · GHSA-5r8q-9fwv-2gpr · Published 28/03/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-1003044 ist eine Schwachstelle (HOCH (CVSS 7.1)) in org.jenkins-ci.plugins:slack, slack notification (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 66.1% aller Schwachstellen.
Abhilfe: auf 2.20 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:slack Maven	`< 2.20`	`2.20`
slack notification jenkins	`≤ 2.19`	No fix yet

Description

A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-1003044 · ADVISORY
jenkinsci/slack-plugin commit 0268bbe · WEB
jenkinsci/slack-plugin · PACKAGE
jenkins.io/security/advisory/2019-03-25 · WEB
openwall.com/lists/oss-security/2019/03/28/2 · WEB
securityfocus.com/bid/107628 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:slack

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:slack

Maven

< 2.20

2.20

slack notification

jenkins

≤ 2.19

No fix yet

Description

NVD description