CVEvulnerability
CVE-2019-10384
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
Affected configurations
• jenkins jenkins (<= 2.176.2)
• jenkins jenkins (<= 2.191)
• oracle communications cloud native core automated test suite 1.9.0
• redhat openshift container platform 3.11
• redhat openshift container platform 4.1
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://www.openwall.com/lists/oss-security/2019/08/28/4 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2789 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3144 Third Party Advisory
- https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491 Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/08/28/4 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2789 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3144 Third Party Advisory
- https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491 Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory