Cross-site request forgery in Jenkins LTS and Jenkins - CVE-2019-10353
Published: July 22, 2019
Vulnerability identifier: #VU19279
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-10353
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to the CSRF tokens by default only check user authentication and IP address. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
This vulnerability allows an attacker to obtain a CSRF token for another user to implement CSRF attacks as long as the victim’s IP address remained unchanged.
Affected software
Jenkins LTS
Jenkins
Red Hat OpenShift Container Platform
Jenkins
Red Hat OpenShift Container Platform
How to mitigate CVE-2019-10353
Install updates from vendor's website.
Jenkins LTS - update to 2.176.2
Jenkins - update to 2.186
Jenkins - update to 2.186