BIT-jenkins-2020-2160

vendorUSosv

view advisory published 2024-03-06Licence: per source

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-2160US	high8.8	2.04% (81st)	—	2020-03-25
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2020/03/25/2ADVISORY
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-2160WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan