Jenkins Cross-Site Request Forgery Vulnerability in Login Form

A cross-site request forgery (CSRF) vulnerability exists in Jenkins versions through 2.540 and LTS versions through 2.528.2. This vulnerability allows attackers to trick users into logging into the attacker's account by exploiting the absence of a CSRF token requirement for interactive login requests.

Impact

Exploitation of this vulnerability allows for cross-site request forgery, enabling attackers to impersonate users by logging into their accounts.

Remediation

Users can update to Jenkins version 2.541 or LTS version 2.528.3, both of which address this vulnerability. In case of issues, the CSRF protection can be disabled by setting the system property 'hudson.security.AuthenticationProcessingFilter2.skipCSRFCheck' to 'true'.