Cross-Site Request Forgery in Jenkins
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-10353US | high7.5 | — | ||
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2019/07/17/2WEB
- https://access.redhat.com/errata/RHSA-2019:2503WEB
- https://access.redhat.com/errata/RHSA-2019:2548WEB
- https://github.com/jenkinsci/jenkins/commit/772152315aa0a9ba27b812a4ba0f3f9b64af78d9WEB
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626WEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-10353ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan