CVE-2019-10384 | BDVDB-2026-121968 Detail

Jenkins projectJenkins

Description#

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.openwall.com/lists/oss-security/2019/08/28/4
https://access.redhat.com/errata/RHSA-2019:2789
https://access.redhat.com/errata/RHSA-2019:3144
https://www.oracle.com/security-alerts/cpuapr2022.html
https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491

Exploit#

No public exploit known

History#

Version 12019-08-28Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.