CVE-2019-16550
Cross-site request forgery (CSRF) vulnerability in Jenkins Maven Release Plugin
8.8
HIGH
CVSS 3.1
EPSS 0.12%
Description
A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.
How to fix CVE-2019-16550
To remediate CVE-2019-16550, upgrade the affected package to a fixed version below.
- —upgrade to 0.16.2 or later
Is CVE-2019-16550 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.16.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |