Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2019-1003011

UNKNOWN
Published 2019-02-06T16:00:00
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2019-1003011. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins Token Macro Plugin

Affected Versions:

2.5 and earlier

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

GHSA-23h9-m55m-c5jp

Advisory Details

Jenkins Token Macro Plugin recursively applied token expansion. This could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service. Most tokens have been changed to no longer recursively apply token expansion.

Affected Packages

Maven org.jenkins-ci.plugins:token-macro
ECOSYSTEM: ≥0 <2.6

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-1003011
WEB https://github.com/jenkinsci/token-macro-plugin/commit/70163600031ea8d43833e6eea928f8fa2e44f96a
WEB https://access.redhat.com/errata/RHBA-2019:0326
WEB https://access.redhat.com/errata/RHBA-2019:0327
WEB https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102

Advisory provided by GitHub Security Advisory Database. Published: May 13, 2022, Modified: October 25, 2023

References

https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102
https://access.redhat.com/errata/RHBA-2019:0326
https://access.redhat.com/errata/RHBA-2019:0327
Published: 2019-02-06T16:00:00
Last Modified: 2024-08-05T03:00:19.329Z
Copied to clipboard!