Description
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/03/25/2
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774
Related Vulnerabilities
CVE-2021-26118 Vulnerability in maven package org.apache.activemq:artemis-openwire-protocol
CVE-2018-1000863 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2019-12402 Vulnerability in maven package org.apache.commons:commons-compress
CVE-2022-23944 Vulnerability in maven package org.apache.shenyu:shenyu-common
CVE-2020-2323 Vulnerability in maven package io.jenkins.plugins:chaos-monkey