UpHeron
All vulnerabilities

Servers and applications

CVE-2019-10405

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

Severity
Medium 5.4
Published
25 Sept 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
65% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version up to 2.176.3
  • Every version up to 2.196

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-10405
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-10405