Intrusion Prevention

Jenkins.CI.Server.Multiple.CSRF

Description

This indicates an attack attempt against a Cross-Site Request-Forgery vulnerability in Jenkins CI.
The vulnerability is due to insufficient sanitization of user supplied inputs in the application. An attacker may exploit this to cause the server to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application.

Affected Products

Jenkins Jenkins mainline prior to 2.57
Jenkins Jenkins LTS prior to 2.46.2

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://jenkins.io/security/advisory/2017-04-26/#csrf-multiple-vulnerabilities

CVE References

CVE-2017-1000356