Multiple Cross-Site Request Forgery vulnerabilities in Jenkins allowed malicious users to perform several administrative actions by tricking a victim into opening a web page. The most notable ones:

    SECURITY-412: Restart Jenkins immediately, after all builds are finished, or after all plugin installations and builds are finished
    SECURITY-412: Schedule a downgrade of Jenkins to a previously installed version if Jenkins previously upgraded itself
    SECURITY-413: Install and (optionally) dynamically load any plugin present on a configured update site
    SECURITY-414: Remove any update site from the Jenkins configuration
    SECURITY-415: Change a user’s API token
    SECURITY-416: Submit system configuration
    SECURITY-417: Submit global security configuration
    SECURITY-418, SECURITY-420: For Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process
    SECURITY-419: Create a new agent, possibly executing arbitrary shell commands on the master node by choosing the appropriate launch method
    SECURITY-420: Cancel a scheduled restart
    SECURITY-420: Configure the global logging levels
    SECURITY-420: Create a copy of an existing agent
    SECURITY-420: Create copies of views in users' "My Views" or as children of the experimental "Tree View" feature
    SECURITY-420: Enter "quiet down" mode in which no new builds are started
    SECURITY-420: On Windows, after successful installation as a service, restart
    SECURITY-420: On Windows, try to install Jenkins as a service
    SECURITY-420: Set the descriptions of items (jobs), builds, and users
    SECURITY-420: Submit global tools configuration (Jenkins 2.0 and up)
    SECURITY-420: Toggle keeping a build forever (i.e. exclude or include it in log rotation)
    SECURITY-420: Try to connect all disconnected agents simultaneously
    SECURITY-420: Update the node monitor data on all agents

Affected versions:

    All Jenkins main line releases up to and including 2.56
    All Jenkins LTS releases up to and including 2.46.1

Fixed in:

    Jenkins main line users should update to 2.57
    Jenkins LTS users should update to 2.46.2

External Reference:

https://jenkins.io/security/advisory/2017-04-26/