Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 12 09 | — | Upgrade Jenkins to version 1.641Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 1.625.3Upgrade Jenkins LTS to the latest version | Nov 13, 2017 | Feb 3, 2016 |
| Redhat Openshift | — | Upgrade rhcUpgrade nodejs-is-streamUpgrade nodejs-strip-json-commentsUpgrade jenkinsUpgrade nodejs-write-file-atomicUpgrade openshift-ansibleUpgrade nodejs-lodash.createassignerUpgrade openshift-origin-broker-utilUpgrade nodejs-lowercase-keysUpgrade nodejs-anymatchUpgrade nodejs-mkdirpUpgrade nodejs-fromUpgrade nodejs-ansi-greenUpgrade nodejs-update-notifierUpgrade nodejs-graceful-fsUpgrade nodejs-xdg-basedirUpgrade nodejs-glob-baseUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-pinkie-promiseUpgrade nodejs-splitUpgrade heapsterUpgrade nodejs-for-inUpgrade nodejs-uuidUpgrade nodejs-success-symbolUpgrade nodejs-parse-jsonUpgrade openshift-origin-node-proxyUpgrade nodejs-iniUpgrade nodejs-unzip-responseUpgrade nodejs-array-uniqueUpgrade nodejs-ps-treeUpgrade nodejs-touchUpgrade nodejs-expand-rangeUpgrade nodejs-is-equal-shallowUpgrade nodejs-lodash.baseassignUpgrade nodejs-arr-flattenUpgrade nodejs-is-extglobUpgrade nodejs-es6-promiseUpgrade nodejs-create-error-classUpgrade nodejs-is-numberUpgrade nodejs-is-binary-pathUpgrade nodejs-nodemonUpgrade nodejs-url-parse-laxUpgrade nodejs-rcUpgrade nodejs-kind-ofUpgrade nodejs-node-status-codesUpgrade nodejs-object.omitUpgrade nodejs-os-homedirUpgrade nodejs-error-exUpgrade nodejs-slideUpgrade nodejs-for-ownUpgrade nodejs-timed-outUpgrade nodejs-prepend-httpUpgrade nodejs-parse-globUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-deep-extendUpgrade nodejs-event-streamUpgrade openshift-origin-cartridge-phpUpgrade nodejs-randomaticUpgrade atomic-openshiftUpgrade nodejs-duplexerUpgrade nodejs-undefsafeUpgrade nodejs-lodash.basecopyUpgrade nodejs-semver-diffUpgrade nodejs-throughUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-os-tmpdirUpgrade nodejs-pinkieUpgrade nodejs-lodash.defaultsUpgrade nodejs-configstoreUpgrade openshift-origin-cartridge-pythonUpgrade origin-kibanaUpgrade nodejs-is-npmUpgrade rubygem-openshift-origin-commonUpgrade nodejs-is-extendableUpgrade nodejs-ansi-wrapUpgrade nss_wrapperUpgrade nodejs-glob-parentUpgrade nodejs-filename-regexUpgrade nodejs-capture-stack-traceUpgrade nodejs-extglobUpgrade nodejs-pause-streamUpgrade openshift-enterprise-upgradeUpgrade nodejs-gotUpgrade nodejs-semverUpgrade nodejs-regex-cacheUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-lodash.getnativeUpgrade nodejs-latest-versionUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-arr-diffUpgrade nodejs-lodash.isiterateecallUpgrade openvswitchUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-repeat-elementUpgrade nodejs-readdirpUpgrade nodejs-lazy-cacheUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-fill-rangeUpgrade phpUpgrade nodejs-lodash.assignUpgrade nodejs-lodash.keysUpgrade nodejs-read-all-streamUpgrade nodejs-normalize-pathUpgrade openshift-origin-cartridge-cronUpgrade nodejs-micromatchUpgrade nodejs-map-streamUpgrade nodejs-bracesUpgrade nodejs-preserveUpgrade nodejs-object-assignUpgrade nodejs-duplexifyUpgrade nodejs-string-lengthUpgrade nodejs-arrifyUpgrade nodejs-lodash.restparamUpgrade nodejs-is-redirectUpgrade nodejs-is-dotfileUpgrade nodejs-expand-bracketsUpgrade nodejs-package-jsonUpgrade nodejs-is-primitiveUpgrade nodejs-async-each | Jun 18, 2018 | Dec 9, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub