PT-2019-5268 · Jenkins · Jenkins

Published 2019-08-28 · Updated 2023-10-25 · CVE-2019-10384

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.191 and earlier Jenkins LTS versions 2.176.2 and earlier

Description The issue is related to cross-site request forgery (CSRF) and allows users to obtain CSRF tokens without an associated web session ID. This results in CSRF tokens that do not expire and can be used to bypass CSRF protection for the anonymous user. The vulnerability may allow an attacker to impact the integrity, confidentiality, and availability of protected information.

Recommendations For Jenkins versions 2.191 and earlier, update to a version later than 2.191 to resolve the issue. For Jenkins LTS versions 2.176.2 and earlier, update to a version later than 2.176.2 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2020-02162

CVE-2019-10384

GHSA-VCR8-H8QP-QJ8H

RHSA-2019:2789

RHSA-2019:3144

Affected Products

Jenkins

References · 14

• https://osv.dev/vulnerability/CVE-2019-10384 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3144 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://bdu.fstec.ru/vul/2020-02162 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10384 · Security Note
• https://osv.dev/vulnerability/GHSA-vcr8-h8qp-qj8h · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2789 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/ace5965b45ba77665e4dd168314665df63527a62 · Note
• https://access.redhat.com/security/cve/cve-2019-10384 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1747298 · Note
• https://openwall.com/lists/oss-security/2019/08/28/4 · Note
• http://openwall.com/lists/oss-security/2019/08/28/4 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10384 · Note