logo

Database

Sensitive information sent insecurely In org.jenkins-ci.main:jenkins-core

Description

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2019-104052. NVD-2019-104053. OSV-2019-104054. GCVE-2019-10405

References

1. https://github.com/jenkinsci/jenkins/commit/560ee832b41814660c5632ea36ad1a1c977177bf2. https://jenkins.io/security/advisory/2019-09-25/#SECURITY-15053. http://www.openwall.com/lists/oss-security/2019/09/25/34. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10405.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.