Cross-site request forgery (CSRF) vulnerability in Jenkins Maven Release Plugin

高危 8.8CVE-2019-16550 · GHSA-g2x8-xw86-vpq3 · Published 17/12/2019 · updated 17/06/2026

要点

CVE-2019-16550 是影响 org.jenkins-ci.plugins.m2release:m2release, maven (jenkins) 的高危 (CVSS 8.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.80%，高于 56.6% 的漏洞。
修复：升级到 0.16.2 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins.m2release:m2release Maven	`< 0.16.2`	`0.16.2`
maven jenkins	`≤ 0.16.1`	No fix yet

Description

A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-16550 · ADVISORY
jenkinsci/m2release-plugin commit 1e4d6fe · WEB
jenkinsci/m2release-plugin · PACKAGE
jenkins.io/security/advisory/2019-12-17 · WEB
openwall.com/lists/oss-security/2019/12/17/1 · WEB

org.jenkins-ci.plugins.m2release:m2release 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins.m2release:m2release

Maven

< 0.16.2

0.16.2

maven

jenkins

≤ 0.16.1

No fix yet

Description

NVD description

org.jenkins-ci.plugins.m2release:m2release 的其他漏洞

查看全部 →