A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected Packages

Maven org.jenkins-ci.plugins:slack

Affected versions: 0 (fixed in 2.20)

Related CVEs

CVE-2019-1003044

Key Information

GHSA ID

GHSA-5r8q-9fwv-2gpr

Published

May 13, 2022 1:25 AM

Last Modified

January 9, 2024 10:32 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:slack

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.