VulnerabilityModified
CVE-2019-10405
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
MEDIUM 5.4EPSS 65.3%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 65.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 65.29% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- jenkins/jenkins
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.