CVE-2019-10307
Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
- Record
CVE-2019-10307- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
- Record
CVE-2019-10307- Updated
- 2026-11-02
EUVDEUVD-2022-2242 No score
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
- Record
EUVD-2022-2242- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3v9f-4vff-rx42
Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability
Jenkins analysis-core Plugin has the capability to allow other plugins to display trend graphs for their static analysis results. analysis-core Plugin provides the configuration form for the default settings of each graph.
The configuration form and form submission handler did not perform a permission check, allowing attackers with Job/Read access to change the per-job graph configuration defaults for all users.
Additionally, the form submission handler did not require POST requests, resulting in a cross-site request forgery vulnerability.
analysis-core Plugin now requires Job/Configure permission and POST requests to configure the per-job graph defaults for all users.
- Record
GHSA-3v9f-4vff-rx42- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
- Record
CVE-2019-10307- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-3v9f-4vff-rx42
Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability
Jenkins analysis-core Plugin has the capability to allow other plugins to display trend graphs for their static analysis results. analysis-core Plugin provides the configuration form for the default settings of each graph.
The configuration form and form submission handler did not perform a permission check, allowing attackers with Job/Read access to change the per-job graph configuration defaults for all users.
Additionally, the form submission handler did not require POST requests, resulting in a cross-site request forgery vulnerability.
analysis-core Plugin now requires Job/Configure permission and POST requests to configure the per-job graph defaults for all users.
- Record
GHSA-3v9f-4vff-rx42- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jvnet.hudson.plugins:analysis-coreMaven |
through 1.95 | 1.96 |
org.jvnet.hudson.plugins:analysis-coreMaven |
before 1.96, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.141.151.161.171.181.191.201.211.221.231.241.251.261.271.281.291.31.301.311.321.331.341.351.361.371.381.391.41.401.411.421.431.441.451.461.471.481.491.51.501.511.521.531.54 |
1.96 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10307 is a medium vulnerability (CVSS 6.5) in Jenkins Static Analysis Utilities, published April 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in org.jvnet.hudson.plugins:analysis-core 1.96.
References
openwall.com/lists/oss-security/2019/04/30/5
securityfocus.com/bid/108159
jenkins.io/security/advisory/2019-04-30
nvd.nist.gov/vuln/detail/CVE-2019-10307
web.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159
github.com/jenkinsci/analysis-core-plugin/commit/3d7a0c7907d831c58541508b893dcea2039809c5
Left out here: 43 versions. The JSON record has them.