CVE-2013-0327: Jenkins Cross-Site Request Forgery vulnerability in org.jenkins-ci.main:jenkins-core
Summary
CVE-2013-0327: Jenkins Cross-Site Request Forgery vulnerability. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.480.3
>= 1.481, < 1.502
Fixed in 1.480.3 or 1.502, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that helps automate various tasks in software development. The 'org.jenkins-ci.main:jenkins-core' package is a core component of Jenkins, responsible for its fundamental functionality. It provides features such as job scheduling, build management, and user authentication.
Vulnerability Detail
The Jenkins master in versions before 1.502 and LTS before 1.480.3 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This vulnerability allows remote attackers to hijack the authentication of users through unknown vectors. CSRF attacks occur when an attacker tricks a victim into performing an unwanted action on a trusted website, leading to potential unauthorized access, data manipulation, or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.480.31.480.3 -
>= 1.481, < 1.5021.502
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement CSRF protection measures manually. This can be achieved by configuring Jenkins to require a unique token for each user session. By enabling this feature, Jenkins will validate the presence of the token in each request, mitigating the risk of CSRF attacks. The following code snippet demonstrates how to enable CSRF protection in Jenkins:
<jenkins>
<crumbIssuer>
<defaultCrumbIssuer class="hudson.security.csrf.DefaultCrumbIssuer">
<excludeClientIPFromCrumb>false</excludeClientIPFromCrumb>
</defaultCrumbIssuer>
</crumbIssuer>
</jenkins>
Conclusion
The Jenkins Cross-Site Request Forgery vulnerability in the 'org.jenkins-ci.main:jenkins-core' package can lead to unauthorized access and potential data manipulation. It is crucial to upgrade the package to version 1.502 or higher to mitigate this vulnerability. Additionally, enabling CSRF protection and following security best practices will further enhance the security of your Jenkins installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows attackers to hijack the authentication of Jenkins users, potentially gaining unauthorized access to sensitive information or performing malicious actions on behalf of legitimate users.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this CSRF vulnerability.
The details of the attack vectors are unknown, but CSRF vulnerabilities can be exploited through various means, such as tricking users into clicking malicious links or visiting compromised websites. It is crucial to address this vulnerability promptly to mitigate the risk of potential exploits.
Yes, a patch is available for this vulnerability. Upgrading the 'org.jenkins-ci.main:jenkins-core' package to version 1.502 or higher will include the necessary security fixes to protect against CSRF attacks.
In addition to upgrading the package and enabling CSRF protection, it is recommended to follow security best practices such as regularly updating Jenkins, implementing strong user authentication mechanisms, and restricting access to the Jenkins master to trusted networks or IP ranges.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
