PT-2019-5268 · Jenkins · Jenkins

Publicado 2019-08-28 · Atualizado 2023-10-25 · CVE-2019-10384

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.191 and earlier Jenkins LTS versions 2.176.2 and earlier

Description The issue is related to cross-site request forgery (CSRF) and allows users to obtain CSRF tokens without an associated web session ID. This results in CSRF tokens that do not expire and can be used to bypass CSRF protection for the anonymous user. The vulnerability may allow an attacker to impact the integrity, confidentiality, and availability of protected information.

Recommendations For Jenkins versions 2.191 and earlier, update to a version later than 2.191 to resolve the issue. For Jenkins LTS versions 2.176.2 and earlier, update to a version later than 2.176.2 to resolve the issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2020-02162

CVE-2019-10384

GHSA-VCR8-H8QP-QJ8H

RHSA-2019:2789

RHSA-2019:3144

Produtos afetados

Jenkins

Referências · 14

• https://github.com/jenkinsci/jenkins/commit/ace5965b45ba77665e4dd168314665df63527a62 · Nota
• https://osv.dev/vulnerability/CVE-2019-10384 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:3144 · Aviso do Fabricante
• https://oracle.com/security-alerts/cpuapr2022.html · Correção
• https://bdu.fstec.ru/vul/2020-02162 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2019-10384 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1747298 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10384 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vcr8-h8qp-qj8h · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2019/08/28/4 · Nota
• https://access.redhat.com/errata/RHSA-2019:2789 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/08/28/4 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10384 · Nota