CVE-2019-1003028

A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint.

• CWE-918

• http://www.securityfocus.com/bid/107295Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1033Vendor Advisory
• http://www.securityfocus.com/bid/107295Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1033Vendor Advisory

Published

Feb 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1003022A denial of service vulnerability exists in Jenkins Monitori…
• CVE-2019-1003023A cross-site scripting vulnerability exists in Jenkins Warni…
• CVE-2019-1003024A sandbox bypass vulnerability exists in Jenkins Script Secu…8.8
• CVE-2019-1003025A exposure of sensitive information vulnerability exists in …8.8
• CVE-2019-1003026A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003027A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003029A sandbox bypass vulnerability exists in Jenkins Script Secu…9.9
• CVE-2019-1003030A sandbox bypass vulnerability exists in Jenkins Pipeline: G…9.9
• CVE-2019-1003031A sandbox bypass vulnerability exists in Jenkins Matrix Proj…9.9
• CVE-2019-1003032A sandbox bypass vulnerability exists in Jenkins Email Exten…9.9
• CVE-2019-1003033A sandbox bypass vulnerability exists in Jenkins Groovy Plug…8.8
• CVE-2019-1003034A sandbox bypass vulnerability exists in Jenkins Job DSL Plu…9.9