GHSA-hcxf-rq72-h4rr

Cross-Site Request Forgery in Jenkins

Source: GitHub Advisory Database (reviewed) High CVE-2019-10353

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	< 2.176.2	2.176.2
Maven	org.jenkins-ci.main:jenkins-core	>= 2.177, < 2.186	2.186

Details

As written in the advisory (Markdown source, shown as plain text).

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10353 advisory
https://github.com/jenkinsci/jenkins/commit/772152315aa0a9ba27b812a4ba0f3f9b64af78d9 web
https://access.redhat.com/errata/RHSA-2019:2503 web
https://access.redhat.com/errata/RHSA-2019:2548 web
https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626 web
http://www.openwall.com/lists/oss-security/2019/07/17/2 web