{
  "threat_severity" : "Important",
  "public_date" : "2019-07-17T00:00:00Z",
  "bugzilla" : {
    "description" : "jenkins: CSRF protection tokens did not expire  (SECURITY-626)",
    "id" : "1730877",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1730877"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.1",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-352",
  "details" : [ "CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.", "A flaw was found in Jenkins in weekly versions prior to 2.186 and LTS versions prior to 2.176.2. By default, CSRF tokens in Jenkins only checked user authentication and IP address which allowed attackers able to obtain a CSRF token for another user. This allowed an attacker to implement CSRF attacks as long as the victim’s IP address remained unchanged. The highest threat from this vulnerability is to data confidentiality and integrity." ],
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "release_date" : "2019-08-15T00:00:00Z",
    "advisory" : "RHSA-2019:2503",
    "cpe" : "cpe:/a:redhat:openshift:3.11::el7",
    "package" : "jenkins-0:2.176.2.1563460897-1.el7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.1",
    "release_date" : "2019-08-28T00:00:00Z",
    "advisory" : "RHSA-2019:2548",
    "cpe" : "cpe:/a:redhat:openshift:4.1::el7",
    "package" : "jenkins-0:2.176.2.1563461785-1.el7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 3.10",
    "fix_state" : "Will not fix",
    "package_name" : "jenkins",
    "cpe" : "cpe:/a:redhat:openshift:3.10"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.6",
    "fix_state" : "Will not fix",
    "package_name" : "jenkins",
    "cpe" : "cpe:/a:redhat:openshift:3.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.7",
    "fix_state" : "Will not fix",
    "package_name" : "jenkins",
    "cpe" : "cpe:/a:redhat:openshift:3.7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.9",
    "fix_state" : "Will not fix",
    "package_name" : "jenkins",
    "cpe" : "cpe:/a:redhat:openshift:3.9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-10353\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-10353\nhttps://jenkins.io/security/advisory/2019-07-17/#SECURITY-626" ],
  "name" : "CVE-2019-10353",
  "csaw" : false
}