A missing permission check in Jenkins Project Inheritance Plugin 19.08.01 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates.

Affected Packages

Maven hudson.plugins:project-inheritance

Affected versions: 0 (fixed in 19.08.02)

Related CVEs

CVE-2019-10409

Key Information

GHSA ID

GHSA-gpmw-h4wq-4rch

Published

May 24, 2022 4:56 PM

Last Modified

January 30, 2024 9:18 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

hudson.plugins:project-inheritance

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.