Description

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

Remediation

References

CVE-2019-10384

Related Vulnerabilities

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4544)

Artifactory Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-10324)

Apache HTTP Server Other Vulnerability (CVE-2004-0885)

Oracle Database Server CVE-2015-0457 Vulnerability (CVE-2015-0457)

MySQL CVE-2020-14725 Vulnerability (CVE-2020-14725)

Severity

High

Classification

CVE-2019-10384 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities