Description
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.
Remediation
References
Related Vulnerabilities
WordPress Plugin Nextend Twitter Connect Cross-Site Scripting (1.5.0)
WordPress Plugin Facebook Like Box Cross-Site Request Forgery (2.8.2)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4279)
Ruby on Rails Uncontrolled Resource Consumption Vulnerability (CVE-2020-8185)