Description
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.
Remediation
References
Related Vulnerabilities
Drupal Core 6.x Remote Code Execution (6.0 - 6.38)
WordPress Plugin PollDeep Arbitrary File Upload (1.2)
WordPress Plugin All-In-One Security (AIOS)-Security and Firewall Directory Traversal (5.1.4)
LimeSurvey Improper Certificate Validation Vulnerability (CVE-2019-16179)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-0113)