GitHub Advisoryadvisory · Maven

GHSA-hcxf-rq72-h4rr Cross-Site Request Forgery in Jenkins

HIGH Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10353
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-06-28

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.176.2 → fixed in 2.176.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.177, < 2.186 → fixed in 2.186

Description

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

Related

Alias · CVE (1)

  • CVE-2019-10353 CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References