CVE-2019-10405

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting…

published September 25, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.

CVSS
—
EPSS
65%
Percentile
99.3
In the wild
Unconfirmed
What it is

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.65290 · 99.3th percentile
Published
2019-09-25T15:05Z
EPSS history
Timeline
  • 25 SEP 15:05Z
    Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting…
    cvelistv5