Description

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.

Remediation

References

https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506

https://www.oracle.com/security-alerts/cpuapr2022.html

Related Vulnerabilities

CVE-2019-25028 Vulnerability in maven package com.vaadin:vaadin-server

CVE-2022-34187 Vulnerability in maven package aendter.jenkins.plugins:filesystem-list-parameter-plugin

CVE-2017-2650 Vulnerability in maven package cprice404:pipeline-classpath

CVE-2020-16037 Vulnerability in maven package org.webjars.npm:electron

CVE-2023-22457 Vulnerability in maven package org.xwiki.contrib:application-ckeditor-plugins

Severity

Medium

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory Patch Third Party Advisory