Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery

高危 8.8CVE-2019-10468 · GHSA-vx6r-w45x-q3h6 · Published 23/10/2019 · updated 17/06/2026

要点

CVE-2019-10468 是影响 com.elasticbox.jenkins-ci.plugins:kubernetes-ci, kubernetes ci (jenkins) 的高危 (CVSS 8.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.80%，高于 56.7% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
com.elasticbox.jenkins-ci.plugins:kubernetes-ci Maven	`≤ 1.3`	No fix yet
kubernetes ci jenkins	`≤ 1.3`	No fix yet

Description

A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Note: Jenkins has suspended distribution of this plugin.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-10468 · ADVISORY
jenkinsci/kubernetes-ci-plugin · PACKAGE
jenkins.io/security/advisory/2019-10-23 · WEB
plugins.jenkins.io/kubernetes-ci · WEB
openwall.com/lists/oss-security/2019/10/23/2 · WEB
jenkins.io/security/advisory/2019-10-23

com.elasticbox.jenkins-ci.plugins:kubernetes-ci 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.elasticbox.jenkins-ci.plugins:kubernetes-ci

Maven

≤ 1.3

No fix yet

kubernetes ci

jenkins

≤ 1.3

No fix yet

Description

Note: Jenkins has suspended distribution of this plugin.

NVD description

com.elasticbox.jenkins-ci.plugins:kubernetes-ci 的其他漏洞

查看全部 →