CVE-2019-10384
Cross-Site Request Forgery in Jenkins
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
- Record
CVE-2019-10384- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
- Record
CVE-2019-10384- Updated
- 2026-11-02
EUVDEUVD-2022-5344 No score
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
- Record
EUVD-2022-5344- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vcr8-h8qp-qj8h
Cross-Site Request Forgery in Jenkins
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
- Record
GHSA-vcr8-h8qp-qj8h- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
- Record
CVE-2019-10384- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-vcr8-h8qp-qj8h
Cross-Site Request Forgery in Jenkins
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
- Record
GHSA-vcr8-h8qp-qj8h- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVRHSA-2019:2789
Red Hat Security Advisory: OpenShift Container Platform 4.1.16 jenkins security update
- Record
RHSA-2019:2789- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2019:3144
Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update
- Record
RHSA-2019:3144- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.176.2 | 2.176.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.177 to 2.191 | 2.192 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.176.3, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.176.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.177 up to 2.192, plus listed versions 2.1782.1792.1802.1812.182 Show 11 moreShow less2.1832.1842.1852.1862.1872.1892.1902.190.12.190.22.190.32.191 |
2.192 |
jenkinsRed Hat:openshift:4.1::el7 From an advisory covering 2 CVEs |
before 0:2.176.3.1568229898-1.el7 | 0:2.176.3.1568229898-1.el7 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 2 CVEs |
before 0:2.176.3.1569349414-1.el7 | 0:2.176.3.1569349414-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10384 is a high vulnerability (CVSS 8.8) in Jenkins, published August 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.176.3.
References
openwall.com/lists/oss-security/2019/08/28/4
access.redhat.com/errata/RHSA-2019:2789
oracle.com/security-alerts/cpuapr2022.html
jenkins.io/security/advisory/2019-08-28
nvd.nist.gov/vuln/detail/CVE-2019-10384
Show 12 moreShow less
github.com/jenkinsci/jenkins/commit/ace5965b45ba77665e4dd168314665df63527a62
bugzilla.redhat.com/show_bug.cgi?id=1747293
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2789.json
cve.org/CVERecord?id=CVE-2019-10383
Left out here: 497 versions. The JSON record has them.