CVE-2019-1003008
Description
CSRF in Jenkins Warnings Next Generation Plugin allows attackers to execute arbitrary code via a form validation endpoint.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
CSRF in Jenkins Warnings Next Generation Plugin allows attackers to execute arbitrary code via a form validation endpoint.
Vulnerability
A cross-site request forgery (CSRF) vulnerability exists in Jenkins Warnings Next Generation Plugin version 2.1.1 and earlier [1][2]. The flaw is located in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java and affects a form validation HTTP endpoint that does not require a CSRF token [1][2]. This endpoint was originally provided for parsing Groovy scripts as part of the plugin's functionality.
Exploitation
An attacker can exploit this vulnerability by crafting a malicious web page or link that, when visited by an authenticated Jenkins user, triggers a request to the vulnerable form validation endpoint. No special privileges are required beyond the victim being logged into Jenkins. The attack is performed by sending a crafted POST or GET request to the form validation endpoint without proper CSRF protection [1][2].
Impact
Successful exploitation allows an attacker to execute arbitrary code on the Jenkins controller with the permissions of the victim user. This can lead to complete compromise of the Jenkins instance, including potential access to build artifacts, credentials, and the ability to execute builds or scripts [1][2]. The vulnerability is classified as high severity.
Mitigation
The vulnerability is fixed in Warnings Next Generation Plugin version 2.1.2, released on 2019-01-28 [1]. Users should upgrade to at least version 2.1.2 immediately. For users unable to upgrade, no workaround is provided other than to restrict access to the plugin's form validation endpoint or disable the plugin entirely. The plugin is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.jenkins.plugins:warnings-ngMaven | <= 2.1.1 | — |
Affected products
2- Range: 2.1.1 and earlier
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The form validation endpoint lacks sufficient CSRF protection."
Attack vector
An attacker can exploit this cross-site request forgery vulnerability by tricking a logged-in Jenkins user into visiting a malicious web page. This page would contain a crafted request targeting a form validation HTTP endpoint within the Warnings Next Generation Plugin. If the user's browser automatically sends their authentication cookies with the request, the plugin will process the forged request, potentially leading to arbitrary code execution [ref_id=1].
Affected code
The vulnerability resides in the `src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java` file within the Jenkins Warnings Next Generation Plugin. Specifically, it affects versions 2.1.1 and earlier. The issue lies within a form validation HTTP endpoint that is susceptible to cross-site request forgery attacks [ref_id=1].
What the fix does
The advisory indicates that the vulnerability is fixed in Jenkins Warnings Next Generation Plugin 2.2. The fix likely involves implementing CSRF tokens or other appropriate validation mechanisms on the affected form validation endpoint to ensure that requests originate from legitimate user interactions within the Jenkins UI. This prevents unauthorized requests from being processed [ref_id=1].
Preconditions
- configThe Jenkins Warnings Next Generation Plugin must be installed and configured.
- authThe target user must be authenticated to Jenkins.
- networkThe attacker must be able to trick the authenticated user into visiting a malicious web page or interacting with a crafted element.
Generated on Jun 5, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-whf8-3h58-2w9fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-1003008ghsaADVISORY
- jenkins.io/security/advisory/2019-01-28/mitrex_refsource_CONFIRM
- jenkins.io/security/advisory/2019-01-28/ghsaWEB
News mentions
0No linked articles in our index yet.