PT-2019-2964 · Jenkins · Jenkins

Published 2019-07-17 · Updated 2023-10-25 · CVE-2019-10353

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.185 and earlier Jenkins LTS versions 2.176.1 and earlier

Description The issue is related to the absence of a web session identifier in Jenkins, which can be exploited by a remote attacker to perform a cross-site request forgery (CSRF) attack and gain unauthorized access to protected information. Specifically, CSRF tokens in affected Jenkins versions did not expire, allowing attackers who obtain them to bypass CSRF protection.

Recommendations For Jenkins versions 2.185 and earlier, update to a version where CSRF tokens expire to prevent bypassing of CSRF protection. For Jenkins LTS versions 2.176.1 and earlier, update to a version where CSRF tokens expire to prevent bypassing of CSRF protection.

Fix

CSRF

Weakness Enumeration

CWE-352

CWE-626

Related Identifiers

BDU:2019-02940

CVE-2019-10353

GHSA-HCXF-RQ72-H4RR

RHSA-2019:2503

RHSA-2019:2548

Affected Products

Jenkins

References · 12

• https://access.redhat.com/errata/RHSA-2019:2548 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02940 · Security Note
• https://access.redhat.com/errata/RHSA-2019:2503 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10353 · Security Note
• https://osv.dev/vulnerability/GHSA-hcxf-rq72-h4rr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10353 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/772152315aa0a9ba27b812a4ba0f3f9b64af78d9 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10353 · Note
• http://openwall.com/lists/oss-security/2019/07/17/2 · Note
• http://securityfocus.com/bid/109373 · Note
• https://access.redhat.com/security/cve/cve-2019-10353 · Note