CVE-2019-1003011
Last modified
CVE-2019-1003011 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.. EPSS estimates a 2.04% chance of exploitation in the next 30 days.
Description
An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Token Macro | <= 2.5 |
| Redhat | Openshift Container Platform | 3.11 |
References
- https://access.redhat.com/errata/RHBA-2019:0326Third Party Advisory
- https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
- https://access.redhat.com/errata/RHBA-2019:0326Third Party Advisory
- https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1003011?
How severe is CVE-2019-1003011?
How do I fix CVE-2019-1003011?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1003005A sandbox bypass vulnerability exists in Jenkins Script Secu…8.8
- CVE-2019-1003006A sandbox bypass vulnerability exists in Jenkins Groovy Plug…8.8
- CVE-2019-1003007A cross-site request forgery vulnerability exists in Jenkins…
- CVE-2019-1003008A cross-site request forgery vulnerability exists in Jenkins…
- CVE-2019-1003009An improper certificate validation vulnerability exists in J…
- CVE-2019-1003010A cross-site request forgery vulnerability exists in Jenkins…
- CVE-2019-1003012A data modification vulnerability exists in Jenkins Blue Oce…
- CVE-2019-1003013An cross-site scripting vulnerability exists in Jenkins Blue…
- CVE-2019-1003014An cross-site scripting vulnerability exists in Jenkins Conf…
- CVE-2019-1003015An XML external entity processing vulnerability exists in Je…
- CVE-2019-1003016An exposure of sensitive information vulnerability exists in…
- CVE-2019-1003017A data modification vulnerability exists in Jenkins Job Impo…
Are you affected by CVE-2019-1003011?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST