CVE-2019-10353

HIGH

Jenkins < 2.176.1 and < 2.185 - Cross-Site Request Forgery via Non-Expiring Tokens

Title source: llm
STIX 2.1

Description

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

References (5)

Core 5
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/07/17/2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/109373
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2503
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2548

Scores

CVSS v3 7.5
EPSS 0.0017
EPSS Percentile 37.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (3)
jenkins/jenkins < 2.176.1
jenkins/jenkins < 2.185
org.jenkins-ci.main/jenkins-core 0 - 2.176.2Maven
Published Jul 17, 2019
Tracked Since Feb 18, 2026