PT-2019-2964 · Jenkins · Jenkins

Publicado 2019-07-17 · Atualizado 2023-10-25 · CVE-2019-10353

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.185 and earlier Jenkins LTS versions 2.176.1 and earlier

Description The issue is related to the absence of a web session identifier in Jenkins, which can be exploited by a remote attacker to perform a cross-site request forgery (CSRF) attack and gain unauthorized access to protected information. Specifically, CSRF tokens in affected Jenkins versions did not expire, allowing attackers who obtain them to bypass CSRF protection.

Recommendations For Jenkins versions 2.185 and earlier, update to a version where CSRF tokens expire to prevent bypassing of CSRF protection. For Jenkins LTS versions 2.176.1 and earlier, update to a version where CSRF tokens expire to prevent bypassing of CSRF protection.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

CWE-626

Identificadores relacionados

BDU:2019-02940

CVE-2019-10353

GHSA-HCXF-RQ72-H4RR

RHSA-2019:2503

RHSA-2019:2548

Produtos afetados

Jenkins

Referências · 12

• https://github.com/jenkinsci/jenkins/commit/772152315aa0a9ba27b812a4ba0f3f9b64af78d9 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10353 · Nota
• https://access.redhat.com/errata/RHSA-2019:2548 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02940 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2019:2503 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/07/17/2 · Nota
• https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626 · Aviso do Fabricante
• http://securityfocus.com/bid/109373 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10353 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2019-10353 · Nota
• https://osv.dev/vulnerability/GHSA-hcxf-rq72-h4rr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10353 · Aviso do Fabricante