Lucene search

[email protected]CVE-2019-10353

HistoryJul 17, 2019 - 4:15 p.m.

CVE-2019-10353

2019-07-1716:15:12

CWE-352

[email protected]

web.nvd.nist.gov

cve-2019-10353

csrf tokens

jenkins

lts

security

expired tokens

csrf protection

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.0%

JSON

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

Affected configurations

NVD

Node

jenkinsjenkinsRange≤2.176.1lts

jenkinsjenkinsRange≤2.185-

CPENameOperatorVersion
jenkins:jenkinsjenkinsle2.176.1
jenkins:jenkinsjenkinsle2.185

CPE	Name	Operator	Version
jenkins:jenkins	jenkins	le	2.176.1
jenkins:jenkins	jenkins	le	2.185

CNA Affected

[
  {
    "product": "Jenkins",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "2.185 and earlier, LTS 2.176.1 and earlier"
      }
    ]
  }
]