Description

An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins.

Remediation

References

CVE-2018-1000169

Related Vulnerabilities

Dolibarr Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-4197)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-42627)

WordPress Plugin LiteSpeed Cache Cross-Site Scripting (3.6)

WordPress Plugin Booking Ultra Pro Appointments Booking Calendar Multiple Cross-Site Scripting Vulnerabilities (1.0.19)

WordPress Plugin MapSVG Lite Arbitrary File Upload (4.2.4)

Severity

Medium

Classification

CVE-2018-1000169 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities