Jenkins contains a high-severity CSRF vulnerability that allows attackers to hijack user sessions and perform unauthorized actions by exposing the CSRF token in dynamically generated JavaScript.

This is a CSRF protection bypass caused by the exposure of the security crumb as a string literal within an HTTP endpoint serving JavaScript, which can be accessed by an attacker who controls a page on the same site as the Jenkins instance.

The exposure of the CSRF token allows an attacker to bypass critical security controls, effectively granting them the ability to perform any action the victimized user is authorized to execute within Jenkins. Given the CVSS score of 8.8, this flaw poses a significant risk of administrative account compromise, unauthorized configuration changes, or unauthorized build execution, leading to potential integrity and availability loss for the CI/CD pipeline.

Immediate Action: Upgrade to Jenkins 2.580 or later, or upgrade to the respective fixed LTS release (2.568.3 or later).

Proactive Monitoring: Review access logs for suspicious cross-origin requests or anomalous activity originating from users who have not actively interacted with the Jenkins dashboard.

Compensating Controls: Ensure that SameSite cookie attributes are strictly configured and utilize a Content Security Policy (CSP) to restrict the loading of resources from untrusted domains.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a critical threat to the security of the Jenkins environment by allowing an attacker to impersonate legitimate users. Organizations must prioritize applying the provided security updates immediately to prevent potential session hijacking and unauthorized command execution.