CVE-2018-1000411
Jenkins JUnit Plugin CSRF vulnerability
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
- Record
CVE-2018-1000411- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
- Record
CVE-2018-1000411- Updated
- 2026-11-02
EUVDEUVD-2022-5753 No score
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
- Record
EUVD-2022-5753- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9gm-m8pp-54vx
Jenkins JUnit Plugin CSRF vulnerability
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
- Record
GHSA-x9gm-m8pp-54vx- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
- Record
CVE-2018-1000411- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-x9gm-m8pp-54vx
Jenkins JUnit Plugin CSRF vulnerability
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
- Record
GHSA-x9gm-m8pp-54vx- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:junitMaven |
through 1.25 | 1.26 |
org.jenkins-ci.plugins:junitMaven |
before 1.26, plus listed versions 1.01.11.101.111.12 Show 26 moreShow less1.131.141.151.181.191.21.2-beta-11.2-beta-21.2-beta-31.2-beta-41.201.211.221.22-beta-11.22.11.22.21.231.241.251.31.41.51.61.71.81.9 |
1.26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000411 is a medium vulnerability (CVSS 6.5) in Jenkins Junit, published January 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in org.jenkins-ci.plugins:junit 1.26.
References
jenkins.io/security/advisory/2018-09-25
securityfocus.com/bid/106532
nvd.nist.gov/vuln/detail/CVE-2018-1000411
github.com/jenkinsci/junit-plugin/commit/091ee0dc8dd6023713827ce1a5914fa9fa9b6043
web.archive.org/web/20200227092927/http://www.securityfocus.com/bid/106532