Description
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
Remediation
References
Related Vulnerabilities
Ruby Improper Restriction of XML External Entity Reference Vulnerability (CVE-2021-28965)
Moodle Other Vulnerability (CVE-2004-0725)
GlassFish CVE-2018-2911 Vulnerability (CVE-2018-2911)
WordPress Plugin WP Page Builder Cross-Site Scripting (1.2.6)
MediaWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-41799)