Patchfirst
Patchfirst
CVE-2019-10405 Public exploit EPSS 65.3%

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the…

Jenkins project · Jenkins

Summary

The Jenkins project's Jenkins software (versions 2.196 and earlier, and LTS 2.176.3 and earlier) prints the value of the Cookie HTTP request header on the /whoAmI/ URL. An attacker who can exploit a separate cross-site scripting vulnerability in Jenkins can use it to read the HTTP session cookie, even though that cookie is marked HttpOnly.

Official description · CVE.org

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 25 Sep 2019. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.

Mavenorg.jenkins-ci.main:jenkins-coreGHSA-47wc-p5cp-w7pw

Upgrade to 2.555.3 or later

Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2020-2230, CVE-2024-23897, +3).

Set the version to 2.555.3 or later in your pom.xml or build.gradle.

First fixed in 2.197 for CVE-2019-10405.

Affected versions, by release line

If you runUpgrade to
2.177 up to 2.1972.555.3first fix for this CVE: 2.197
All versions before 2.176.4

Still affected on this line by CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).

2.176.4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 1

jenkins.io/security/advisory/2019-09-25/#SECURITY-1505

mailing-list 1

openwall.com/lists/oss-security/2019/09/25/3
↑ ↓ chooseEnter openEsc close