Description

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.

Remediation

References

CVE-2015-5318

Related Vulnerabilities

Moodle Other Vulnerability (CVE-2004-1711)

WordPress Plugin MW WP Form Cross-Site Scripting (1.7.1)

PHP CVE-2006-5706 Vulnerability (CVE-2006-5706)

WordPress Plugin Request a Quote Cross-Site Scripting (2.3.3)

concrete5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-6905)

Severity

Medium

Classification

CVE-2015-5318 CWE-352

Tags

Missing Update Known Vulnerabilities