CVE-2019-1003011 - CVE House

Back to Database

Status published High CVE-2019-1003011

An information exposure and denial of service vulnerability exists in...

8.1 CVSS

Vulnerability Description

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-1003011

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Jenkins project

View All →

Jenkins Associated Files Plugin 0.2.1 and earlier does not escape...

Jenkins JAPEX Plugin 1.7 and earlier does not configure its...

A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6...

A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics...

Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2...

Affected Vendor

Jenkins project

View all reports →

Affected Software

Jenkins Token Macro Plugin

Vulnerable Versions:

2.5 and earlier

Timeline

Official Publish: February 6th, 2019

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.