CVE-2019-10310

A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins
Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:ansible_tower:*:*:*:*:*:jenkins:*:*

History

No history.

Information

Published : 2019-04-30 13:29

Updated : 2024-02-28 17:08


NVD link : CVE-2019-10310

Mitre link : CVE-2019-10310

CVE.ORG link : CVE-2019-10310


JSON object : View

Products Affected

jenkins

  • ansible_tower
CWE
CWE-352

Cross-Site Request Forgery (CSRF)