Description

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

Remediation

References

CVE-2019-10384

Related Vulnerabilities

Oracle Database Server CVE-2008-0339 Vulnerability (CVE-2008-0339)

PHP Other Vulnerability (CVE-2007-1452)

WordPress 6.2.x Multiple Vulnerabilities (6.2 - 6.2.2)

XWiki URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-32068)

WordPress Plugin WPCafe-Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce Local File Inclusion (2.2.25)

Severity

High

Classification

CVE-2019-10384 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities