Description

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.

Remediation

References

https://access.redhat.com/errata/RHSA-2016:0070

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01

Related Vulnerabilities

CVE-2022-45143 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2021-32729 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-script

CVE-2020-2243 Vulnerability in maven package org.jenkins-ci.plugins:vmanager-plugin

CVE-2020-1936 Vulnerability in maven package org.apache.ambari:ambari-web

CVE-2019-1003033 Vulnerability in maven package org.jenkins-ci.plugins:groovy

Severity

Critical

Tags

Vendor Advisory CWE-200