Cross-site Request Forgery (CSRF) Affecting org.jenkins-ci.main:jenkins-core package, versions [,2.228)
Threat Intelligence
EPSS
0.08% (35th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-561370
- published 26 Mar 2020
- disclosed 25 Mar 2020
- credit Nick Collisson from Gemini Trust Company, LLC.
Introduced: 25 Mar 2020
CVE-2020-2160 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to version 2.228 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open source automation server.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). Jenkins uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
References
CVSS Scores
version 3.1