CVE-2019-10384

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

Published: Aug 28, 2019
Updated: Oct 26, 2023
CVE: CVE-2019-10384
GHSA: GHSA-vcr8-h8qp-qj8h
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-352

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.176.2.x
jenkins / jenkins	-	2.191.x
oracle / communications_cloud_native_core_automated_test_suite	1.9.0	1.9.0.x
redhat / openshift_container_platform	3.11	3.11.x
redhat / openshift_container_platform	4.1	4.1.x
org.jenkins-ci.main / jenkins-core	-	2.176.3
org.jenkins-ci.main / jenkins-core	2.177	2.192

http://www.openwall.com/lists/oss-security/2019/08/28/4
https://access.redhat.com/errata/RHSA-2019:2789
https://access.redhat.com/errata/RHSA-2019:3144
https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491
https://www.oracle.com/security-alerts/cpuapr2022.html

Vulnerability Database

289,697

CVE-2019-10384