CVE-2019-10384

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did…

published August 28, 2019

CVSS
—
EPSS
2%
Percentile
75.2
In the wild
Unconfirmed
What it is

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01572 · 75.2th percentile
Published
2019-08-28T15:30Z
EPSS history
Timeline
  • 28 AUG 15:30Z
    Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did…
    cvelistv5