~ / search / GHSA-x6jw-2f23-mc5j

GHSA-x6jw-2f23-mc5j

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000068

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core < 2.89.4 2.89.4
Maven org.jenkins-ci.main:jenkins-core >= 2.90, < 2.107 2.107

Details

As written in the advisory (Markdown source, shown as plain text).

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.

References

External links from the advisory. They lead to third-party sites.