Cross-Site Request Forgery in Jenkins
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-10384US | high8.8 | — | ||
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2019/08/28/4WEB
- https://access.redhat.com/errata/RHSA-2019:2789WEB
- https://access.redhat.com/errata/RHSA-2019:3144WEB
- https://github.com/jenkinsci/jenkins/commit/ace5965b45ba77665e4dd168314665df63527a62WEB
- https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491WEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-10384ADVISORY
- https://www.oracle.com/security-alerts/cpuapr2022.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan