Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Advisory: Jenkins — RHBA-2020:0402 Clear all filters
TI-2020-01981 CVE-2020-2104 · GHSA-r78q-qgx6-64pp

Incorrect authorization in Jenkins

Priority LOW 22

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01074 Published 2020-01-29 Fixed in 2.204.2, 2.219 CWE-863
TI-2020-01980 CVE-2020-2103 · GHSA-4jjj-cm7q-v6hr

Information disclosure in Jenkins

Priority LOW 34

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.07044 Published 2020-01-29 Fixed in 2.219, 2.204.2 CWE-200
TI-2020-01978 CVE-2020-2101 · GHSA-w7jr-wqw6-54xc

Observable discrepancy in Jenkins

Priority LOW 27

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret…

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01368 Published 2020-01-29 Fixed in 2.204.2, 2.219 CWE-203
TI-2020-01976 CVE-2020-2099 · GHSA-qp4f-2w67-c8hw

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key…

Priority LOW 39

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection s…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01012 Published 2020-01-29 Fixed in 2.204.2, 2.214 CWE-330