Vulnerability record · CVE-2019-10300 · published 18 April 2019

CVE-2019-10300: Jenkins gitlab cross-site request forgery vulnerability

Jenkins · Gitlab

A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

8.0 CVSS 3.0 High EPSS 1.3% · top 30.1% CWE-352 · Cross-site request forgery

8.0CVSS 3.0 base score, v2 3.5

1.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Gitlab Jenkins

References

Link	Tags
http://www.securityfocus.com/bid/108045	Third Party AdvisoryVDB Entry
https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357	Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0788
http://www.securityfocus.com/bid/108045	Third Party AdvisoryVDB Entry
https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357	Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0788

Track CVE-2019-10300 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2019-10301Jenkins gitlab missing authorization vulnerabilityA missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed …EPSS 1.3%18 Apr 2019 6.5CVE-2022-30955Jenkins gitlab missing authorization vulnerabilityJenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to …EPSS 0.89%17 May 2022 5.4CVE-2022-34777Jenkins GitLab Plugin stored XSS in webhook build descriptionsJenkins GitLab Plugin 1.5.34 and earlier fails to escape multiple fields inserted into the description of webhook-triggered builds, creating a stored…EPSS 73%analysed30 Jun 2022 5.3CVE-2022-43411Jenkins gitlab observable discrepancy vulnerabilityJenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token a…EPSS 0.72%19 Oct 2022 4.3CVE-2025-24397Jenkins gitlab incorrect authorization vulnerabilityAn incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/C…EPSS 0.30%22 Jan 2025 9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed26 Nov 2025 8.1CVE-2008-4128Cisco IOS HTTP Administration CSRF allows arbitrary command executionThe HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router is vulnerable to multiple cross-site request forgery flaws.…KEVEPSS 34%analysed18 Sep 2008 8.8CVE-2023-2533PaperCut NG/MF CSRF allows admin security setting changes and code executionPaperCut NG and MF contain a cross-site request forgery flaw that, under specific conditions, lets an attacker change security settings or execute ar…KEVEPSS 29%analysed20 Jun 2023

Source: NIST National Vulnerability Database (record CVE-2019-10300), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.