Jenkins Multiple Security Vulnerabilities
BID:109373
CVE-2019-10353 | CVE-2019-10354 |Info
Jenkins Multiple Security Vulnerabilities
| Bugtraq ID: | 109373 |
| Class: | Unknown |
| CVE: |
CVE-2019-10353 CVE-2019-10354 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 17 2019 12:00AM |
| Updated: | Jul 17 2019 12:00AM |
| Credit: | Jesse Glick, CloudBees, Inc |
| Vulnerable: |
Jenkins-Ci Jenkins LTS 2.176.1 Jenkins-Ci Jenkins LTS 2.150.1 Jenkins-Ci Jenkins LTS 2.138.4 Jenkins-Ci Jenkins LTS 2.138.3 Jenkins-Ci Jenkins LTS 2.89.4 Jenkins-Ci Jenkins LTS 2.89.3 Jenkins-Ci Jenkins LTS 2.73.3 Jenkins-Ci Jenkins LTS 2.73.2 Jenkins-Ci Jenkins LTS 2.73.1 Jenkins-Ci Jenkins LTS 2.46.2 Jenkins-Ci Jenkins LTS 2.46.1 Jenkins-Ci Jenkins LTS 2.32.2 Jenkins-Ci Jenkins LTS 2.32.1 Jenkins-Ci Jenkins LTS 2.19.3 Jenkins-Ci Jenkins LTS 2.19.2 Jenkins-Ci Jenkins LTS 1.652.2 Jenkins-Ci Jenkins LTS 1.651.2 Jenkins-Ci Jenkins LTS 1.651.1 Jenkins-Ci Jenkins LTS 1.642.2 Jenkins-Ci Jenkins LTS 1.642.1 Jenkins-Ci Jenkins LTS 1.625.3 Jenkins-Ci Jenkins LTS 1.625.2 Jenkins-Ci Jenkins LTS 1.625.1 Jenkins-Ci Jenkins LTS 1.609.1 Jenkins-Ci Jenkins LTS 1.580.1 Jenkins-Ci Jenkins LTS 1.565.3 Jenkins-Ci Jenkins LTS 2.107.2 Jenkins-Ci Jenkins LTS 2.107.1 Jenkins Jenkins 2.138.1 Jenkins Jenkins 2.185 Jenkins Jenkins 2.172 Jenkins Jenkins 2.171 Jenkins Jenkins 2.170 Jenkins Jenkins 2.169 Jenkins Jenkins 2.168 Jenkins Jenkins 2.167 Jenkins Jenkins 2.166 Jenkins Jenkins 2.165 Jenkins Jenkins 2.164 Jenkins Jenkins 2.163 Jenkins Jenkins 2.162 Jenkins Jenkins 2.161 Jenkins Jenkins 2.160 Jenkins Jenkins 2.159 Jenkins Jenkins 2.158 Jenkins Jenkins 2.157 Jenkins Jenkins 2.156 Jenkins Jenkins 2.155 Jenkins Jenkins 2.154 Jenkins Jenkins 2.153 Jenkins Jenkins 2.145 Jenkins Jenkins 2.144 Jenkins Jenkins 2.143 Jenkins Jenkins 2.142 Jenkins Jenkins 2.141 Jenkins Jenkins 2.140 Jenkins Jenkins 2.138 Jenkins Jenkins 2.137 Jenkins Jenkins 2.136 Jenkins Jenkins 2.135 Jenkins Jenkins 2.134 Jenkins Jenkins 2.133 Jenkins Jenkins 2.132 Jenkins Jenkins 2.131 |
| Not Vulnerable: |
Jenkins-Ci Jenkins LTS 2.176.2 Jenkins Jenkins 2.186 |
Discussion
Jenkins Multiple Security Vulnerabilities
Jenkins is prone to the following vulnerabilities:
1. A unauthorized-access vulnerability
2. A cross-site request forgery vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of the victim in the context of the affected site, steal cookie-based authentication credentials and gain unauthorized access to the affected application. This may aid in further attacks.
The following product versions are vulnerable:
Jenkins weekly 2.185 and prior
Jenkins LTS 2.176.1 and prior
Jenkins is prone to the following vulnerabilities:
1. A unauthorized-access vulnerability
2. A cross-site request forgery vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of the victim in the context of the affected site, steal cookie-based authentication credentials and gain unauthorized access to the affected application. This may aid in further attacks.
The following product versions are vulnerable:
Jenkins weekly 2.185 and prior
Jenkins LTS 2.176.1 and prior
Exploit / POC
Jenkins Multiple Security Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Jenkins Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Jenkins Multiple Security Vulnerabilities
References:
References:
- Jenkins Home Page (Jenkins)
- Jenkins Product Page (Jenkins)
- Jenkins Security Advisory 2019-07-17 (Jenkins)