CVE-2023-27904 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Description

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

Remediation

References

https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2120

Related Vulnerabilities

CVE-2016-3094 Vulnerability in maven package org.apache.qpid:qpid-broker-core

CVE-2015-5211 Vulnerability in maven package org.springframework:spring-web

CVE-2023-46656 Vulnerability in maven package igalg.jenkins.plugins:multibranch-scan-webhook-trigger

CVE-2023-24425 Vulnerability in maven package com.cloudbees.jenkins.plugins:kubernetes-credentials-provider

CVE-2013-1965 Vulnerability in maven package org.apache.struts:struts-core

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N