TI-2019-07662 Aliases CVE-2019-10353 GHSA-hcxf-rq72-h4rr

Cross-site request forgery in Jenkins

LOW 36CWE-352Published 2019-07-17 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

Why it matters now

EPSS 0.01502 74th percentileScored 2026-11-07

Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.176.2, 2.186Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins	2.185 and earlier, LTS 2.176.1 and earlier	—	No fix listed	CNA
—	org.jenkins-ci.main:jenkins-core (Maven)	before 2.176.2	2.176.2	Patch available	GHSA-hcxf-rq72-h4rr
—	org.jenkins-ci.main:jenkins-core (Maven)	2.177 to before 2.186	2.186	Patch available	GHSA-hcxf-rq72-h4rr

Jenkins VendorJenkins Affected 2.185 and earlier, LTS 2.176.1 and earlier Fixed in — No fix listed CNA
org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.176.2 Fixed in 2.176.2 Patch available GHSA-hcxf-rq72-h4rr
org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.177 to before 2.186 Fixed in 2.186 Patch available GHSA-hcxf-rq72-h4rr

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:jenkins:::::lts:::*	up to 2.176.1	Vulnerable	Jenkins
cpe:2.3:a:jenkins:jenkins:::::-:::*	up to 2.185	Vulnerable	Jenkins

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.176.1 Vulnerable ·Jenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions up to 2.185 Vulnerable ·Jenkins

Remediation

Fix · GHSA-hcxf-rq72-h4rr org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.176.2 Advisory →
Fix · GHSA-hcxf-rq72-h4rr org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.186 Advisory →

Red Hat 2 advisories

RHSA-2019:2548 Released 2019-08-28 · Red Hat rating Important
OpenShift Container Platform 4.1 jenkins security update
- Red Hat OpenShift Container Platform 4.1 jenkins-2.176.2.1563461785-1.el7
RHSA-2019:2503 Released 2019-08-15 · Red Hat rating Important
OpenShift Container Platform 3.11 jenkins security update
- Red Hat OpenShift Container Platform 3.11 jenkins-2.176.2.1563460897-1.el7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2019-07-17
Jenkins — RHSA-2019:2503
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-07661 Path traversal in JenkinsPriority MEDIUM 41
- TI-2019-07663 Missing authorization in JenkinsPriority LOW 23
Show all 3 records → Advisory →
Advisory · 2019-07-17
Jenkins — RHSA-2019:2548
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-07661 Path traversal in JenkinsPriority MEDIUM 41
- TI-2019-07663 Missing authorization in JenkinsPriority LOW 23
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 3.10	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.6	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.7	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.9	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11	Fixed	RHSA-2019:2503
Red Hat OpenShift Container Platform 4.1	Fixed	RHSA-2019:2548

Timeline

2026-10-02 Threatist record created from CVE-2019-10353
2026-10-03 Alias added: GHSA-hcxf-rq72-h4rr

References

Advisory 5

Other 1

https://github.com/jenkinsci/jenkins/commit/772152315aa0a9ba27b812a4ba0f3f9b64af78d9

TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8

See all 293 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences