GitHub Advisory DatabaseGHSA-VCR8-H8QP-QJ8HCross-Site Request Forgery in Jenkins
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
50.5%
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | le | 2.191 | |
| org.jenkins-ci.main:jenkins-core | le | 2.176.2 |
References
www.openwall.com/lists/oss-security/2019/08/28/4
access.redhat.com/errata/RHSA-2019:2789
access.redhat.com/errata/RHSA-2019:3144
github.com/advisories/GHSA-vcr8-h8qp-qj8h
github.com/jenkinsci/jenkins/commit/ace5965b45ba77665e4dd168314665df63527a62
jenkins.io/security/advisory/2019-08-28/#SECURITY-1491
nvd.nist.gov/vuln/detail/CVE-2019-10384
www.oracle.com/security-alerts/cpuapr2022.html
Related
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
50.5%