https://bugzilla.redhat.com/show_bug.cgi?id=1819190
Bug ID: 1819190
Summary: CVE-2020-2160 jenkins: CSRF protection bypass via
crafted URLs
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier
uses different representations of request URL paths, which allows attackers to
craft URLs that allow bypassing CSRF protection of any target URL.
Reference:
http://www.openwall.com/lists/oss-security/2020/03/25/2
--
You are receiving this mail because:
You are on the CC list for the bug.