com.barchart.jenkins:maven-release-cascade (>=1.1.0, <=1.3.2) potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (1.3.0)

org.jenkins-ci.plugins:git MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.barchart.jenkins:maven-release-cascade =1.1.0, =1.3.2 Source cves: CVE-2019-1003010 Source advisory:...

org.jenkins-ci.plugins:git-chooser-alternative (>=1.0, <=1.1) potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (1.4.0)

org.jenkins-ci.plugins:git MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-chooser-alternative =1.0, =1.1 Source cves: CVE-2019-1003010 Source advisory:...

com.coravy.hudson.plugins.github:github (>=1.28.0, <=1.29.4), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +30 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (>=3.0.0, <=3.9.1)

org.jenkins-ci.plugins:git MAVEN version =3.0.0, =1.28.0, =y, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =0.1-preview-4, =2.2.0-alpha-1, =1.0, =1.2 and more Source cves: CVE-2019-1003010 Source advisory:...

org.biouno:uno-choice (>=1.0, <=1.4), org.jenkins-ci.plugins:git-server (1.3) +3 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.0.1)

org.jenkins-ci.plugins:git MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.biouno:uno-choice =1.0, =1.4 - org.jenkins-ci.plugins:git-server 1.3 - org.jenkins-ci.plugins:scriptler...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31), org.jenkins-ci.plugins:bitbucket (>=1.1.2, <=1.1.13) +4 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.3.5)

org.jenkins-ci.plugins:git MAVEN version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =1.1.2, =1.3, =0.1, =1.0.0, =1.6.8, =1.6.11 Source cves:...

org.jenkins-ci.plugins:flaky-test-handler (>=1.0.0, <=1.0.4) potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.2.2)

org.jenkins-ci.plugins:git MAVEN version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:flaky-test-handler =1.0.0, =1.0.4 Source cves: CVE-2019-1003010 Source advisory:...

org.jenkins-ci.plugins:git-bisect (>=1.0, <=1.3) potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.6.0)

org.jenkins-ci.plugins:git MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-bisect =1.0, =1.3 Source cves: CVE-2019-1003010 Source advisory:...

org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-organization-folder (1.6-beta-1) +1 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.6.2-beta-1)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-2) +1 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.6.2-beta-2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.0.0, <=2.0.2-beta-1), org.jenkins-ci.plugins:github-branch-source (>=2.0.0, <=2.0.1-beta-6) +1 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.6.2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.0.0, =2.0.0, =2.0.1-beta-6 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.6.4)

org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...

org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.3)

org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...

com.coravy.hudson.plugins.github:github (>=1.28.0, <=1.29.4), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +30 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (>=3.0.0, <=3.9.1)

org.jenkins-ci.plugins:git MAVEN version =3.0.0, =1.28.0, =y, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =1.0.0-b19-beta-1, =0.1-preview-4, =2.2.0-alpha-1, =1.0, =1.2 and more Source cves: CVE-2019-1003010 Source advisory:...

CVE-2019-1003010

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record...

br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1), com.amcbridge:build-configurator (>=1.0.5.0, <=1.0.6.1) +91 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (>=1.2.0, <=3.9.1)

org.jenkins-ci.plugins:git MAVEN version =1.2.0, =1.0.5.0, =1.1.0, =1.9.2-beta, =1.9, =4.0.9, =1.1.0, =1.0.0, =1.0.1, =1.1.3, =1.7.2, =1.1.0, =1.0.0, =1.0.22, =1.0.57 and more Source cves: CVE-2019-1003010 Source advisory: MEND:CVE-2019-1003010...

CVE-2019-1003010

The CVE-2019-1003010 entry concerns Jenkins Git Plugin (versions 3.9.1 and earlier). The issue is a cross-site request forgery in src/main/java/hudson/plugins/git/GitTagAction.java that lets an attacker create a Git tag in a workspace and attach metadata to a build record. The documents do not sp...