CVE-2019-1003084: A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDe...

Security readout for executives and security teams

This Jenkins plugin flaw could let an attacker trick a Jenkins user’s browser into making Jenkins connect to a server chosen by the attacker. The source bundle does not provide CVSS, confirmed exploitation, or a fixed version, so urgency depends on whether the affected plugin is installed and exposed in your Jenkins environment. Organizations are likely exposed only if they run Jenkins with the Zephyr Enterprise Test Management Plugin installed. Risk is higher where Jenkins users can be targeted through a browser and Jenkins can make outbound network connections to untrusted destinations. Treat this as a targeted Jenkins exposure issue, not a broad internet emergency based on the supplied evidence. Prioritize environments where the plugin exists on production CI/CD systems, because Jenkins often has sensitive credentials and privileged network reach. Mitigation focus: Inventory Jenkins instances for the Zephyr Enterprise Test Management Plugin.; Check Jenkins advisory SECURITY-993 and plugin guidance for supported fixes or status.; If no fix is available, consider disabling or removing the plugin after impact review..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.