high7.5
CVE-2019-10353
Cross-Site Request Forgery in Jenkins
Impact
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | <= 2.176.1 | 2.176.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 2.176.1 through 2.185 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2019/07/17/2
- http://www.securityfocus.com/bid/109373
- https://access.redhat.com/errata/RHSA-2019:2503
- https://access.redhat.com/errata/RHSA-2019:2548
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626
- https://github.com/advisories/GHSA-hcxf-rq72-h4rr
- https://nvd.nist.gov/vuln/detail/CVE-2019-10353
- https://github.com/jenkinsci/jenkins/commit/772152315aa0a9ba27b812a4ba0f3f9b64af78d9