Description
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
Remediation
References
Related Vulnerabilities
TYPO3 Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-7073)
WordPress Plugin WP Statistics Multiple Cross-Site Scripting Vulnerabilities (2.2.4)
WordPress Plugin Banner Slider Cross-Site Scripting (1.0)
WordPress Plugin Zero BS WordPress CRM Cross-Site Request Forgery (2.99.9)
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-3093)