Description
The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2016-1773.html
https://access.redhat.com/errata/RHSA-2016:1206
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
https://www.cloudbees.com/jenkins-security-advisory-2016-05-11
Related Vulnerabilities
CVE-2011-4367 Vulnerability in maven package org.apache.myfaces.core:myfaces-impl
CVE-2022-47500 Vulnerability in maven package org.apache.helix:helix-front
CVE-2011-5064 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2020-1952 Vulnerability in maven package org.apache.iotdb:iotdb-server
CVE-2020-2306 Vulnerability in maven package org.jenkins-ci.plugins:mercurial