CVE-2019-10405

MEDIUMNuclei

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2019-10405 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Jenkins

Browse Jenkins project / Jenkins
CVE List2.196 and earlier, LTS 2.176.3 and earlieraffected

org.jenkins-ci.main:jenkins-core

Browse Maven / org.jenkins-ci.main:jenkins-core
GitHub AdvisoryBefore 2.176.4 · Fixed in 2.176.4affected
2.177 to < 2.197 · Fixed in 2.197affected

Nuclei templates

1
ProjectDiscoveryMEDIUMJenkins <=2.196 - Cookie ExposureCVSS 5.4

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue.

Impact

The exposure of cookies can lead to session hijacking, unauthorized access, and potential data breaches.

Remediation

Upgrade Jenkins to a version higher than 2.196 to mitigate the vulnerability.

WeaknessesCWE-79
Authorsc-sh0
Template tagscvecve2019jenkinsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
Shodan: http.favicon.hash:81586312
Shodan: cpe:"cpe:2.3:a:jenkins:jenkins"
Shodan: product:"jenkins"
FOFA: icon_hash=81586312
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505 http://www.openwall.com/lists/oss-security/2019/09/25/3 https://nvd.nist.gov/vuln/detail/CVE-2019-10405 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4