Description

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

Remediation

References

CVE-2019-10384

Related Vulnerabilities

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-46251)

WordPress Plugin Classified Listing Pro & Directory Cross-Site Scripting (2.0.19)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-5732)

WordPress Plugin WP-Live Chat by 3CX Cross-Site Scripting (7.0.06)

WordPress Plugin Fancy Gallery 'image-upload.php' Arbitrary File Upload (1.2.4)

Severity

High

Classification

CVE-2019-10384 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities