CVE-2019-10405

CVE-2019-10405: vulnerability in Jenkins

Published · Updated

Follow this CVE+ Monitor Jenkins+ Monitor org.jenkins-ci.main:jenkins-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

30Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 65%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (4 components)
Red Hat OpenShift Container Platform 3.10 · Red Hat OpenShift Container Platform 3.9
no_fix_planned: Out of support scope
Fixed
2 products (4 components)
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4.3
fix ↗
Not affected
2 products (445 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 4.3 · Red Hat OpenShift Container Platform 3.11
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Affected products
Jenkins project · Jenkins
Related CVEs — Jenkins

In the same product, most dangerous first.

CVE-2020-2230—CVE-2020-2230EPSS 82.7%CVE-2019-10352—CVE-2019-10352EPSS 10.0%CVE-2020-2103—CVE-2020-2103EPSS 7.0%CVE-2020-2229—CVE-2020-2229EPSS 6.8%CVE-2020-2231—CVE-2020-2231EPSS 5.3%CVE-2022-0538—CVE-2022-0538EPSS 3.9%