Description
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/03/25/2
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774
Related Vulnerabilities
CVE-2020-2293 Vulnerability in maven package org.jenkins-ci.plugins:persona
CVE-2021-3803 Vulnerability in npm package nth-check
CVE-2022-29230 Vulnerability in npm package @shopify/hydrogen
CVE-2022-36918 Vulnerability in maven package org.jenkins-ci.plugins:buckminster
CVE-2019-6002 Vulnerability in maven package com.linecorp.centraldogma:centraldogma-server