Vulnerability record · CVE-2019-10405 · published 25 September 2019
CVE-2019-10405: Jenkins /whoAmI/ endpoint leaks HttpOnly session cookie value
Jenkins · Jenkins
Jenkins 2.196 and earlier, and LTS 2.176.3 and earlier, printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL. Because the session cookie is marked HttpOnly, this endpoint defeats that protection by exposing the cookie value in the response body, which an attacker can read via a separate XSS flaw.
Description
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Automated analysis
medium priorityCVSS rates it medium (5.4) and it requires chaining with a separate XSS flaw, but the high EPSS percentile and session-hijack impact warrant prompt patching.
What it is
Jenkins 2.196 and earlier, and LTS 2.176.3 and earlier, printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL. Because the session cookie is marked HttpOnly, this endpoint defeats that protection by exposing the cookie value in the response body, which an attacker can read via a separate XSS flaw.
Impact
An attacker who can execute script in the victim's browser through another XSS vulnerability can read the session cookie from /whoAmI/ and hijack the authenticated Jenkins session, bypassing the HttpOnly flag.
Attack surface
Reached over the network via the /whoAmI/ URL; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N), though the description frames the leak as chained with a separate XSS flaw.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record; EPSS is high at 0.6529 (99.22nd percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Upgrade Jenkins to a version after 2.196 (or LTS after 2.176.3) that no longer prints the Cookie header on /whoAmI/.
- If immediate upgrade is not possible, restrict access to the /whoAmI/ endpoint and remove or mask the Cookie header from responses.
- Remediate any XSS vulnerabilities in the Jenkins instance, since this flaw is only exploitable in combination with one.
- Rotate session cookies and invalidate active sessions after patching to cut off any sessions already leaked.
Detection
- Monitor web logs for requests to /whoAmI/ and inspect responses for Cookie header values.
- Alert on anomalous or scripted access patterns to /whoAmI/ from unusual source IPs or user agents.
- Hunt for XSS payloads in Jenkins request parameters that could be used to read the /whoAmI/ response.
- Review Jenkins authentication logs for session reuse or hijacking indicators following /whoAmI/ access.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2019/09/25/3 | Mailing ListThird Party Advisory |
| https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2019/09/25/3 | Mailing ListThird Party Advisory |
| https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505 | Vendor Advisory |
Track CVE-2019-10405 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-10405), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
