CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 0 (fixed in 2.176.2)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.177 (fixed in 2.186)

Related CVEs

CVE-2019-10353

Key Information

GHSA ID

GHSA-hcxf-rq72-h4rr

Published

May 24, 2022 4:50 PM

Last Modified

June 28, 2022 10:58 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:jenkins-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.