Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12Y3I4LWg4cXAtcWo4aM4AAh6e

Cross-Site Request Forgery in Jenkins

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

Permalink: https://github.com/advisories/GHSA-vcr8-h8qp-qj8h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Y3I4LWg4cXAtcWo4aM4AAh6e
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 11 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-vcr8-h8qp-qj8h, CVE-2019-10384
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10384
• https://access.redhat.com/errata/RHSA-2019:2789
• https://access.redhat.com/errata/RHSA-2019:3144
• https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491
• https://www.oracle.com/security-alerts/cpuapr2022.html
• http://www.openwall.com/lists/oss-security/2019/08/28/4
• https://github.com/jenkinsci/jenkins/commit/ace5965b45ba77665e4dd168314665df63527a62
• https://github.com/advisories/GHSA-vcr8-h8qp-qj8h

Repository: https://github.com/jenkinsci/jenkins
Blast Radius: 1.0

Affected Packages