CVE-2019-10405: XSS
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10405?
CVE-2019-10405 is considered a medium severity vulnerability due to its potential for session hijacking through exposed HTTP session cookies.
How do I fix CVE-2019-10405?
To fix CVE-2019-10405, upgrade Jenkins to version 2.197 or later, or to version 2.176.4 or later for LTS.
What does CVE-2019-10405 affect?
CVE-2019-10405 affects Jenkins versions up to 2.196 and LTS versions up to 2.176.3.
What impact does CVE-2019-10405 have?
The impact of CVE-2019-10405 allows attackers to exploit a cross-site scripting vulnerability to retrieve HTTP session cookies from affected Jenkins instances.
Is CVE-2019-10405 easily exploitable?
CVE-2019-10405 is considered moderately exploitable as it requires an attacker to leverage another XSS vulnerability.