CVE-2019-1003011: jenkins project jenkins token macro plugin Uncontrolled Recursion

Modified

AliasesGHSA-23h9-m55m-c5jp

Published 06-02-2019Last modified 05-08-2024

Vulnerability summary

CVE-2019-1003011 is a high (CVSS 8.1) Uncontrolled Recursion vulnerability in jenkins project jenkins token macro plugin. EPSS estimates a 2.04% chance of exploitation in the next 30 days, higher than 81.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.1/10

010

High · v3.1 (NVD)

EPSS score

2.04%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHBA-2019:0326

Timeline

06-02-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.