Description

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.

Remediation

References

https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506

https://www.oracle.com/security-alerts/cpuapr2022.html

Related Vulnerabilities

CVE-2023-48223 Vulnerability in npm package fast-jwt

CVE-2019-16540 Vulnerability in maven package org.jenkins-ci.plugins:support-core

CVE-2023-38690 Vulnerability in npm package matrix-appservice-irc

CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:api-ldap-client-all

CVE-2023-49280 Vulnerability in maven package org.xwiki.contrib.changerequest:application-changerequest-default

Severity

Medium

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory Patch Third Party Advisory