{"id":"CVE-2019-10405","published":"2019-09-25T15:05:32Z","modified":"2024-08-04T22:24:16Z","title":"Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the \"Cookie\" HTTP request header on the…","vendor":"Jenkins project","product":"Jenkins","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins","versions":["2.196 and earlier, LTS 2.176.3 and earlier"]}],"description":{"text":"Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the \"Cookie\" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Jenkins project's Jenkins software (versions 2.196 and earlier, and LTS 2.176.3 and earlier) prints the value of the Cookie HTTP request header on the /whoAmI/ URL. An attacker who can exploit a separate cross-site scripting vulnerability in Jenkins can use it to read the HTTP session cookie, even though that cookie is marked HttpOnly.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:46Z"},"cvss":null,"epss":{"score":0.6529,"percentile":0.99253,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2019/09/25/3","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<2.176.4",">=2.177, <2.197"],"patched":["2.176.4","2.197"],"from":["GHSA-47wc-p5cp-w7pw"],"provenance":"source"}],"advisories":[{"id":"GHSA-47wc-p5cp-w7pw","url":"https://github.com/advisories/GHSA-47wc-p5cp-w7pw","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<2.176.4"],"patched":["2.176.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-47wc-p5cp-w7pw","url":"https://github.com/advisories/GHSA-47wc-p5cp-w7pw","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":[">=2.177, <2.197"],"patched":["2.197"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2334","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2334","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2019-10405","name":"Jenkins <=2.196 - Cookie Exposure","severity":"medium","path":"http/cves/2019/CVE-2019-10405.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10405.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-09-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-10405","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9925"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}