CVE-2013-2034: Jenkins Cross-Site Request Forgery vulnerabilities in org.jenkins-ci.main:jenkins-core
Summary
CVE-2013-2034: Jenkins Cross-Site Request Forgery vulnerabilities. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.509.1
>= 1.513, < 1.514
Fixed in 1.509.1 or 1.514, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerability affects the jenkins-core package in the Maven ecosystem.
Vulnerability Detail
Multiple cross-site request forgery (CSRF) vulnerabilities have been discovered in Jenkins versions before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests that can execute arbitrary code or initiate deployment of binaries to a Maven repository. The exact vectors of attack are unspecified.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.509.11.509.1 -
>= 1.513, < 1.5141.514
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a secure version of Jenkins.
Conclusion
The CSRF vulnerabilities in Jenkins pose a moderate risk as they allow attackers to hijack the authentication of administrators and perform unauthorized actions. It is crucial to upgrade to a secure version of Jenkins to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects.
Cross-site request forgery is an attack that tricks the victim into submitting a malicious request. In the context of Jenkins, it allows an attacker to perform actions on behalf of an authenticated user without their consent.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
The exact vectors of attack for these CSRF vulnerabilities in Jenkins are unspecified. However, it is crucial to apply the recommended fix to mitigate the risk of potential exploits.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fg4r-f9j2-36mw/GHSA-fg4r-f9j2-36mw.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
