Description
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.196 and earlier, LTS 2.176.3 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.204.1.1578490170-1.el7 | RHBA-2020:0063 |
| Red Hat OpenShift 4 | openshift +1 | 4.3.0-202001131753.git.0.0aee6a8.el7 | RHBA-2020:0063 |
| Red Hat OpenShift 3 | jenkins | 2.176.4.1578402941-1.el7 | RHBA-2020:0017 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.10 | jenkins | 2.199-r0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jenkins <=2.196 - Cookie Exposure http/cves/2019/CVE-2019-10405.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.176.4 | 2.176.4 | GHSA-47wc-p5cp-w7pw |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.177, < 2.197 | 2.197 | GHSA-47wc-p5cp-w7pw |
Advisories 2
- RHBA-2020:0063 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3 RPM release advisory Red Hat Security Advisories (RHSA) · May 19, 2026
- RHBA-2020:0017 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025