Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens...

References

• advisory http://www.openwall.com/lists/oss-security/2019/08/28/4
• advisory https://access.redhat.com/errata/RHSA-2019:2789
• advisory https://access.redhat.com/errata/RHSA-2019:3144
• advisory https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491
• patch https://www.oracle.com/security-alerts/cpuapr2022.html