{"id":"CVE-2018-1000414","published":"2019-01-09T23:00:00Z","modified":"2024-08-05T12:40:46Z","title":"A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in…","vendor":null,"product":null,"tier":"tail","description":{"text":"A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00835,"percentile":0.57561,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/106532","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://jenkins.io/security/advisory/2018-09-25/#SECURITY-938","tags":["x_refsource_CONFIRM"]}],"priority":{"score":11.5,"factors":[{"name":"EPSS percentile","points":11.51}]},"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:config-file-provider","vulnerableRanges":["<3.2"],"patched":["3.2"],"from":["GHSA-r5m8-5mwx-cmj8"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5101","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jenkins-config-file-provider-plugin-cve-2018-1000413","children":[{"from":"CVE-2018-1000414","to":"CVE-2019-1003014","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:config-file-provider","fromFixed":"3.2","toFixed":"3.5","daysApart":28},{"kind":"same-code","provenance":"machine","files":["src/main/resources/lib/configfiles/configfiles.jelly","src/main/resources/lib/configfiles/providerlist.jelly"],"commits":["https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33","https://github.com/jenkinsci/config-file-provider-plugin/commit/64fba993c897ff52a9c6c38c6c41806f2e8cc73f"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2017-1000104","published":"2017-10-04","fixed":"2.16.2","kev":false},{"cve":"CVE-2018-1000413","published":"2019-01-09","fixed":"3.2","kev":false},{"cve":"CVE-2018-1000414","published":"2019-01-09","fixed":"3.2","kev":false},{"cve":"CVE-2019-1003014","published":"2019-02-06","fixed":"3.5","kev":false},{"cve":"CVE-2021-21642","published":"2021-04-21","fixed":"3.7.1","kev":false},{"cve":"CVE-2021-21643","published":"2021-04-21","fixed":"3.7.1","kev":false}],"package":"Maven:org.jenkins-ci.plugins:config-file-provider"}}