Jenkins CVE-2013-2034 Cross-Site Request Forgery Vulnerability

Bugtraq ID:	59631
Class:	Input Validation Error
CVE:	CVE-2013-2034
Remote:	Yes
Local:	No
Published:	May 02 2013 12:00AM
Updated:	May 02 2013 12:00AM
Credit:	Reported by the vendor
Vulnerable:	Jenkins-Ci Jenkins 1.513 Jenkins-Ci Jenkins 1.509 Jenkins-Ci Jenkins 1.502
Not Vulnerable:	Jenkins-Ci Jenkins 1.514 Jenkins-Ci Jenkins 1.509.1

Jenkins CVE-2013-2034 Cross-Site Request Forgery Vulnerability

Jenkins is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Versions prior to Jenkins 1.514 and 1.509.1 are vulnerable.

Jenkins CVE-2013-2034 Cross-Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jenkins CVE-2013-2034 Cross-Site Request Forgery Vulnerability

References:

• Jenkins CI Homepage (Jenkins CI)
  
• Jenkins Security Advisory 2013-05-02 (Jenkins CI)