CVE-2019-10321

MEDIUM Year: 2019
CVSS v3 Score
4.3
Medium
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-352
View all →

Vulnerability Description

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Related Vulnerabilities

CVE-2005-1947

MEDIUM
CVSS:4.3(Medium)

Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) deli...

CWE-3522005

CVE-2014-10382

MEDIUM
CVSS:4.3(Medium)

The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

CWE-3522014

CVE-2014-3655

MEDIUM
CVSS:4.3(Medium)

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

CWE-3522014

CVE-2015-10001

MEDIUM
CVSS:4.3(Medium)

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege us...

CWE-3522015

CVE-2015-10130

MEDIUM
CVSS:4.3(Medium)

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail...

CWE-3522015

CVE-2015-9418

MEDIUM
CVSS:4.3(Medium)

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

CWE-3522015