Jenkins project Jenkins
At a glance
- Source
- NVD
- EPSS
- EPSS 1.57 % · percentile 75 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- jenkins
- NVD status
- Modified
Description
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
Weaknesses (CWE)
- CWE-352 — Cross-Site Request Forgery
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-vcr8-h8qp-qj8h — Cross-Site Request Forgery in Jenkins
European references
- ENISA EUVD · EUVD-2022-5344
- GCVE · GCVE-0-2019-10384
Affected configurations (NVD CPE)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*≤ 2.176.2cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*≤ 2.191cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Jenkins project · Jenkins | affected 2.191 and earlier, LTS 2.176.2 and earlier |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |