GHSA-99hj-ppg3-2xwc

Suggest an improvement
Source
https://github.com/advisories/GHSA-99hj-ppg3-2xwc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-99hj-ppg3-2xwc/GHSA-99hj-ppg3-2xwc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-99hj-ppg3-2xwc
Aliases
Published
2022-05-14T01:04:36Z
Modified
2024-03-04T21:31:04.038610Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Cross-Site Request Forgery in Jenkins
Details

A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.

Database specific 
{
    "nvd_published_at": "2018-01-24T23:29:00Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-352"
    ],
    "github_reviewed_at": "2022-07-01T21:45:12Z",
    "github_reviewed": true
}
References

Affected packages

Maven / org.jenkins-ci.main:jenkins-core

Package

Name
org.jenkins-ci.main:jenkins-core
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.main/jenkins-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.81
Fixed
2.89.2

Affected versions

2.*

2.81
2.82
2.83
2.84
2.85
2.86
2.87
2.88
2.89
2.89.1

Database specific

last_known_affected_version_range

"<= 2.89.1"

Maven / org.jenkins-ci.main:jenkins-core

Package

Name
org.jenkins-ci.main:jenkins-core
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.main/jenkins-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.90
Fixed
2.95

Affected versions

2.*

2.90
2.91
2.92
2.93
2.94

Database specific

last_known_affected_version_range

"<= 2.94"