Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Jenkins — RHSA-2019:2503 Clear all filters
TI-2019-07663 CVE-2019-10354 · GHSA-6jfc-mc97-c7wg

Missing authorization in Jenkins

Priority LOW 23

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive infor…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01617 Published 2019-07-17 Partial fix · 2.176.2, 2.186 +1 CWE-862
TI-2019-07662 CVE-2019-10353 · GHSA-hcxf-rq72-h4rr

Cross-site request forgery in Jenkins

Priority LOW 36

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

CVSS 3.0HIGH 7.5 Network No auth User interaction EPSS 0.01502 Published 2019-07-17 Partial fix · 2.176.2, 2.186 CWE-352
TI-2019-07661 CVE-2019-10352 · GHSA-qr42-82qj-mw65

Path traversal in Jenkins

Priority MEDIUM 41

A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter w…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.10042 Published 2019-07-17 Partial fix · 2.176.2, 2.186 CWE-22