CVE-2019-10409
Description
Project Inheritance Plugin 2.0.0 and earlier lacks a permission check, allowing attackers with Overall/Read to trigger project generation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Project Inheritance Plugin 2.0.0 and earlier lacks a permission check, allowing attackers with Overall/Read to trigger project generation.
Vulnerability
CVE-2019-10409 is a missing permission check in the Jenkins Project Inheritance Plugin versions 2.0.0 and earlier. The plugin fails to verify that users have the necessary authorization to trigger project generation from templates, relying only on the presence of Overall/Read permission [1][3].
Exploitation
An attacker with only Overall/Read permission, which is the lowest access level in Jenkins, can exploit this flaw by sending a crafted request to generate projects from pre-defined templates. The attack requires no special privileges beyond the default read access [1].
Impact
Successful exploitation allows the attacker to create arbitrary projects based on templates without proper authorization. This bypasses intended access controls that should restrict project generation to more privileged users, potentially leading to unauthorized configuration changes or information disclosure [1].
Mitigation
Jenkins released Project Inheritance Plugin version 19.08.02 which fixes the missing permission check by adding a proper authorization check before allowing project generation [2]. Users should upgrade to this version or later. No workarounds are mentioned, but the plugin is now corrected.
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
hudson.plugins:project-inheritanceMaven | < 19.08.02 | 19.08.02 |
Affected products
2- Range: 2.0.0 and earlier
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-gpmw-h4wq-4rchghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-10409ghsaADVISORY
- www.openwall.com/lists/oss-security/2019/09/25/3ghsamailing-listx_refsource_MLISTWEB
- jenkins.io/security/advisory/2019-09-25/ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.