CVE-2019-10384 log

Source
Severity Medium
Remote Yes
Type Cross-site request forgery
Description
Jenkins allowed the creation of CSRF tokens without a corresponding web session ID. This is the result of an incomplete fix for SECURITY-626 in the 2019-07-17 security advisory. This allowed attackers able to obtain a CSRF token without associated session ID to implement CSRF attacks with the following constraints. The token had to be created for the anonymous user (and could only be used for actions the anonymous user can perform). The victim’s IP address needed to remain unchanged (unless the proxy compatibility option was enabled) The victim must not have a valid web session at the time of the attack. CSRF token generation now creates a web session if none exists yet, so that the lack of a web session ID cannot be exploited.
Group Package Affected Fixed Severity Status Ticket
AVG-1030 jenkins 2.189-1 2.192-1 Medium Fixed
Date Advisory Group Package Severity Description
30 Aug 2019 ASA-201908-22 AVG-1030 jenkins Medium multiple issues
References
https://jenkins.io/security/advisory/2019-08-28/