Description

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

Remediation

References

CVE-2016-0791

Related Vulnerabilities

WordPress Plugin WCFM-Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible SQL Injection (6.5.11)

WordPress Plugin SMTP Mailer Cross-Site Request Forgery (1.0.6)

WordPress Plugin Themify Portfolio Post Cross-Site Scripting (1.1.9)

MySQL CVE-2015-4836 Vulnerability (CVE-2015-4836)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-1831)

Severity

Critical

Classification

CVE-2016-0791 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities