Description

Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.

Remediation

References

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

https://access.redhat.com/errata/RHSA-2016:0070

http://rhn.redhat.com/errata/RHSA-2016-0489.html

Related Vulnerabilities

CVE-2023-26056 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-macro-context

CVE-2021-3856 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2022-34916 Vulnerability in maven package org.apache.flume.flume-ng-sources:flume-jms-source

CVE-2020-2166 Vulnerability in maven package de.taimos:pipeline-aws

CVE-2020-2321 Vulnerability in maven package org.jenkins-ci.plugins:shelve-project-plugin

Severity

Critical

Classification

CWE-264

Tags

Vendor Advisory