CVE-2016-0791

Critical

Published: 07/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Jenkins before version 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, making it easier for remote attackers to bypass the CSRF protection mechanism via a brute-force approach.

Risk Assessment

Organizations may be vulnerable to attacks that allow bypassing CSRF protections, potentially leading to unauthorized access to the system.

Recommendation

It is recommended to update Jenkins to the latest version to ensure adequate protection against CSRF attacks.

Original NVD description (English source)

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.