vulnerability
Red Hat OpenShift: CVE-2019-10405: jenkins: Diagnostic web page exposed Cookie HTTP header
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:S/C:N/I:P/A:N) | Sep 25, 2019 | Dec 29, 2020 | Apr 11, 2025 |
Severity
4
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:N)
Published
Sep 25, 2019
Added
Dec 29, 2020
Modified
Apr 11, 2025
Description
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Solution
linuxrpm-upgrade-jenkins
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.