Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: Jenkins — Jenkins Security Advisory 2023-09-20 Clear all filters
TI-2023-23255 CVE-2023-43498 · GHSA-hq87-h4jg-vxfw

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using…

Priority LOW 39

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly create…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00966 Published 2023-09-20 Partial fix · 2.424, 2.414.2 CWE-377
TI-2023-23254 CVE-2023-43497 · GHSA-qv64-w99c-qcr9

Unrestricted file upload in Jenkins

Priority LOW 39

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly crea…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00966 Published 2023-09-20 Partial fix · 2.424, 2.414.2 CWE-434
TI-2023-23253 CVE-2023-43496 · GHSA-55wp-3pq4-w8p9

Incorrect default permissions in Jenkins

Priority MEDIUM 42

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01042 Published 2023-09-20 Partial fix · 2.424, 2.414.2 CWE-276
TI-2023-23252 CVE-2023-43495 · GHSA-5j46-5hwq-gwh7

Cross-site scripting in Jenkins

Priority LOW 26

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable b…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0102 Published 2023-09-20 Partial fix · 2.424, 2.414.2 CWE-79
TI-2023-23251 CVE-2023-43494 · GHSA-279f-qwgh-h5mp

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive)…

Priority LOW 27

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.03937 Published 2023-09-20 Partial fix · 2.424, 2.414.2