{"id":"CVE-2019-10315","aliases":["EUVD-2022-4779","GHSA-phwv-crgp-9r69"],"status":"published","title":"Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability","description":"Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02161,"percentile":0.82344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2019-04-30T12:25:17Z","modified":"2026-10-24T10:30:48Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:github-oauth","fixed_in":["0.32"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:github-oauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.31"},{"fixed":"0.32"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:github-oauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32"}]}],"versions":["-rc586.88708ce878fc","0.1","0.10","0.11","0.12","0.13","0.13.1","0.14","0.16","0.17","0.18","0.19","0.2","0.20","0.21","0.21.1","0.21.2","0.22","0.22.1","0.22.2","0.22.3","0.23","0.24","0.25","0.26","0.27","0.28.1","0.29","0.3","0.31","0.4","0.5","0.6","0.7","0.8","0.8.1","0.9"]}],"products":[{"vendor":"jenkins","product":"github_authentication"},{"vendor":"jenkins project","product":"jenkins github authentication plugin"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/04/30/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/108159","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10315","tags":["advisory"]},{"url":"https://web.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159","tags":["web"]},{"url":"https://github.com/advisories/GHSA-phwv-crgp-9r69"}],"sources":{"cve":[{"id":"CVE-2019-10315","description":"Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.","status":"published","published":"2019-04-30T12:25:17Z","modified":"2024-08-04T22:17:20.358Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2022-4779","description":"Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.","status":"published","published":"2019-04-30T12:25:17Z","modified":"2024-08-04T22:17:20Z","updated_at":"2026-11-03T02:40:53.055308Z"}],"ghsa":[{"id":"GHSA-phwv-crgp-9r69","title":"Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability","description":"Jenkins GitHub Authentication Plugin did not manage the state parameter of OAuth to prevent CSRF. This allowed an attacker to catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins account would be attached to the attacker’s GitHub account.\n\nThe state parameter is now correctly managed.","status":"published","published":"2022-05-24T16:44:55Z","modified":"2023-10-26T21:52:02Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:10.053831Z"}],"nvd":[{"id":"CVE-2019-10315","description":"Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.","status":"published","published":"2019-04-30T13:29:05.813Z","modified":"2026-06-17T02:10:42.023Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"CVE-2019-10315","description":"Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.","status":"published","published":"2019-04-30T13:29:05.813Z","modified":"2026-10-24T10:30:48.450842572Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-phwv-crgp-9r69","title":"Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability","description":"Jenkins GitHub Authentication Plugin did not manage the state parameter of OAuth to prevent CSRF. This allowed an attacker to catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins account would be attached to the attacker’s GitHub account.\n\nThe state parameter is now correctly managed.","status":"published","published":"2022-05-24T16:44:55Z","modified":"2024-02-16T08:02:03.731424Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}