CVE-2019-10353
jenkins: CSRF protection tokens did not expire (SECURITY-626)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
Unos tokens de tipo CSRF en Jenkins versiones 2.185 y anteriores, LTS versiones 2.176.1 y anteriores, no expiraron, de este modo permitieron a atacantes capaces de lograrlo omitir la protección de tipo CSRF.
A flaw was found in Jenkins in weekly versions prior to 2.186 and LTS versions prior to 2.176.2. By default, CSRF tokens in Jenkins only checked user authentication and IP address which allowed attackers able to obtain a CSRF token for another user. This allowed an attacker to implement CSRF attacks as long as the victim’s IP address remained unchanged. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-29 CVE Reserved
- 2019-07-17 CVE Published
- 2024-07-10 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2019/07/17/2 | Mailing List |
|
| http://www.securityfocus.com/bid/109373 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2019:2503 | 2023-10-25 | |
| https://access.redhat.com/errata/RHSA-2019:2548 | 2023-10-25 | |
| https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626 | 2023-10-25 | |
| https://access.redhat.com/security/cve/CVE-2019-10353 | 2019-08-28 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1730877 | 2019-08-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Jenkins Search vendor "Jenkins" | Jenkins Search vendor "Jenkins" for product "Jenkins" | <= 2.176.1 Search vendor "Jenkins" for product "Jenkins" and version " <= 2.176.1" | lts |
Affected
| ||||||
| Jenkins Search vendor "Jenkins" | Jenkins Search vendor "Jenkins" for product "Jenkins" | <= 2.185 Search vendor "Jenkins" for product "Jenkins" and version " <= 2.185" | - |
Affected
| ||||||