Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 12 09 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.641Upgrade Jenkins LTS to version 1.625.3 | Nov 13, 2017 | Feb 3, 2016 |
| Redhat Openshift | — | Upgrade nodejs-bracesUpgrade nodejs-is-primitiveUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-lodash.assignUpgrade nodejs-lodash.defaultsUpgrade nodejs-is-npmUpgrade nodejs-normalize-pathUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-lodash.restparamUpgrade nodejs-read-all-streamUpgrade nodejs-fill-rangeUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-strip-json-commentsUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-package-jsonUpgrade nodejs-is-streamUpgrade nodejs-filename-regexUpgrade openshift-enterprise-upgradeUpgrade nodejs-ansi-wrapUpgrade nodejs-ansi-greenUpgrade nodejs-lazy-cacheUpgrade nodejs-duplexifyUpgrade jenkinsUpgrade nodejs-preserveUpgrade nodejs-fromUpgrade nodejs-pause-streamUpgrade nodejs-is-dotfileUpgrade nodejs-arrifyUpgrade nodejs-regex-cacheUpgrade nodejs-graceful-fsUpgrade nodejs-extglobUpgrade nodejs-configstoreUpgrade nodejs-arr-diffUpgrade nodejs-semverUpgrade openshift-origin-cartridge-pythonUpgrade origin-kibanaUpgrade nodejs-lowercase-keysUpgrade nodejs-capture-stack-traceUpgrade nss_wrapperUpgrade nodejs-write-file-atomicUpgrade nodejs-mkdirpUpgrade nodejs-update-notifierUpgrade nodejs-map-streamUpgrade nodejs-is-extendableUpgrade openshift-origin-cartridge-cronUpgrade rubygem-openshift-origin-commonUpgrade nodejs-lodash.getnativeUpgrade nodejs-gotUpgrade nodejs-object-assignUpgrade openvswitchUpgrade nodejs-repeat-elementUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-micromatchUpgrade nodejs-is-redirectUpgrade nodejs-lodash.keysUpgrade nodejs-string-lengthUpgrade nodejs-glob-parentUpgrade nodejs-end-of-streamUpgrade nodejs-throughUpgrade nodejs-deep-extendUpgrade nodejs-pinkie-promiseUpgrade nodejs-is-numberUpgrade nodejs-registry-urlUpgrade nodejs-es6-promiseUpgrade nodejs-event-streamUpgrade nodejs-is-plain-objUpgrade heapsterUpgrade nodejs-for-inUpgrade nodejs-glob-baseUpgrade nodejs-node-status-codesUpgrade nodejs-optimistUpgrade nodejs-semver-diffUpgrade nodejs-rcUpgrade nodejs-error-exUpgrade nodejs-lodash.isargumentsUpgrade nodejs-arr-flattenUpgrade nodejs-os-tmpdirUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-xdg-basedirUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-is-equal-shallowUpgrade nodejs-parse-globUpgrade nodejs-nodemonUpgrade nodejs-kind-ofUpgrade nodejs-is-extglobUpgrade nodejs-unzip-responseUpgrade nodejs-binary-extensionsUpgrade nodejs-expand-rangeUpgrade nodejs-object.omitUpgrade nodejs-for-ownUpgrade nodejs-success-symbolUpgrade nodejs-parse-jsonUpgrade nodejs-duplexerUpgrade nodejs-align-textUpgrade openshift-origin-cartridge-phpUpgrade nodejs-isobjectUpgrade nodejs-is-globUpgrade nodejs-array-uniqueUpgrade nodejs-timed-outUpgrade openshift-origin-node-proxyUpgrade nodejs-osenvUpgrade nodejs-randomaticUpgrade nodejs-lodash.basecopyUpgrade nodejs-url-parse-laxUpgrade nodejs-iniUpgrade nodejs-uuidUpgrade nodejs-undefsafeUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade activemqUpgrade nodejs-os-homedirUpgrade nodejs-lodash.isarrayUpgrade nodejs-stream-combinerUpgrade nodejs-is-binary-pathUpgrade nodejs-ps-treeUpgrade nodejs-touchUpgrade nodejs-slideUpgrade openshift-origin-node-utilUpgrade nodejs-prepend-httpUpgrade nodejs-create-error-classUpgrade nodejs-splitUpgrade atomic-openshiftUpgrade nodejs-lodash.baseassignUpgrade nodejs-chokidar | Jun 18, 2018 | Dec 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub