CVE

CVE-2019-10405

5.4

CVSS

Description

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

Attack Vector

Privileges Req.

User Interaction

jenkins

Updated Sep 28, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2019-10405 Scanner

CVE-2019-10405 scanner - Information Disclosure vulnerability in Jenkins

Used 2.3k times · 3.3k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: jenkins

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →