~ / search / GHSA-2w4x-rxp7-grg7

GHSA-2w4x-rxp7-grg7

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000192

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core < 2.107.3 2.107.3
Maven org.jenkins-ci.main:jenkins-core >= 2.108, < 2.121 2.121

Details

As written in the advisory (Markdown source, shown as plain text).

A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.

References

External links from the advisory. They lead to third-party sites.