GitHub Advisoryadvisory · Maven

GHSA-vcr8-h8qp-qj8h Cross-Site Request Forgery in Jenkins

HIGH Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10384
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-06-28

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.176.3 → fixed in 2.176.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.177, < 2.192 → fixed in 2.192

Description

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

Related

Alias · CVE (1)

  • CVE-2019-10384 Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References