~ / search / GHSA-4653-rmch-3g2g

GHSA-4653-rmch-3g2g

Jenkins has Information Disclosure via Sidepanel Widget

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-5321

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core >= 1.626, < 1.638 1.638
Maven org.jenkins-ci.main:jenkins-core < 1.625.2 1.625.2

Details

As written in the advisory (Markdown source, shown as plain text).

The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.

References

External links from the advisory. They lead to third-party sites.