Description
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/03/25/2
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774
Related Vulnerabilities
CVE-2022-31170 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts
CVE-2020-7627 Vulnerability in npm package node-key-sender
CVE-2019-1003026 Vulnerability in maven package org.jenkins-ci.plugins:mattermost
CVE-2023-37943 Vulnerability in maven package org.jenkins-ci.plugins:active-directory