CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2019-10384
High (8.8). EPSS 1.6% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.176.3, 2.192.
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
- oracle:communications_cloud_native_core_automated_test_suite
- redhat:openshift_container_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vcr8-h8qp-qj8h | Maven | org.jenkins-ci.main:jenkins-core | <2.176.3 | 2.176.3 |
| GHSA-vcr8-h8qp-qj8h | Maven | org.jenkins-ci.main:jenkins-core | >=2.177 <2.192 | 2.192 |