CVE-2019-10353: CSRF
A vulnerability was found in Jenkins versions weekly before 2.186 and LTS before 2.176.2. By default, CSRF tokens in Jenkins only checked user authentication and IP address. This allowed attackers able to obtain a CSRF token for another user to implement CSRF attacks as long as the victim’s IP address remained unchanged.
Other sources
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10353?
CVE-2019-10353 has a medium severity, allowing CSRF protection bypass.
How do I fix CVE-2019-10353?
To fix CVE-2019-10353, update Jenkins to version 2.186 or later, or LTS version 2.176.2 or later.
What versions of Jenkins are affected by CVE-2019-10353?
Jenkins versions prior to 2.186 and LTS versions prior to 2.176.2 are affected by CVE-2019-10353.
What type of vulnerability is CVE-2019-10353?
CVE-2019-10353 is a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2019-10353 be exploited remotely?
Yes, CVE-2019-10353 can be exploited remotely if the attacker obtains the CSRF tokens.