~ / search / GHSA-vcr8-h8qp-qj8h

GHSA-vcr8-h8qp-qj8h

Cross-Site Request Forgery in Jenkins

Source: GitHub Advisory Database (reviewed) High CVE-2019-10384

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core < 2.176.3 2.176.3
Maven org.jenkins-ci.main:jenkins-core >= 2.177, < 2.192 2.192

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

References

External links from the advisory. They lead to third-party sites.