Description
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.
Remediation
References
Related Vulnerabilities
WordPress Plugin Print-O-Matic Cross-Site Scripting (2.0.2)
WordPress Plugin Wordfence Security-Firewall & Malware Scan Cross-Site Scripting (5.2.2)
PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-3062)
WordPress Plugin Event Organiser Cross-Site Scripting (2.12.4)