Detections
Analytics

CVE-2019-10384

high

Description

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

References

https://www.oracle.com/security-alerts/cpuapr2022.html

https://access.redhat.com/errata/RHSA-2019:3144

https://access.redhat.com/errata/RHSA-2019:2789

http://www.openwall.com/lists/oss-security/2019/08/28/4

https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491

Details

Source: Mitre, NVD

Published: 2019-08-28

Updated: 2023-10-25

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00249