Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

2022-05-1301:36:54

Google

osv.dev

0.002 Low

EPSS

Percentile

56.1%

JSON

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction.

CPENameOperatorVersion
org.jenkins-ci.main:jenkins-coreeq1.500
org.jenkins-ci.main:jenkins-coreeq1.571
org.jenkins-ci.main:jenkins-coreeq1.622
org.jenkins-ci.main:jenkins-coreeq1.596.1
org.jenkins-ci.main:jenkins-coreeq1.510
org.jenkins-ci.main:jenkins-coreeq1.616
org.jenkins-ci.main:jenkins-coreeq1.566
org.jenkins-ci.main:jenkins-coreeq1.447
org.jenkins-ci.main:jenkins-coreeq1.416
org.jenkins-ci.main:jenkins-coreeq2.25

Name	Operator	Version
org.jenkins-ci.main:jenkins-core	eq	1.500
org.jenkins-ci.main:jenkins-core	eq	1.571
org.jenkins-ci.main:jenkins-core	eq	1.622
org.jenkins-ci.main:jenkins-core	eq	1.596.1
org.jenkins-ci.main:jenkins-core	eq	1.510
org.jenkins-ci.main:jenkins-core	eq	1.616
org.jenkins-ci.main:jenkins-core	eq	1.566
org.jenkins-ci.main:jenkins-core	eq	1.447
org.jenkins-ci.main:jenkins-core	eq	1.416
org.jenkins-ci.main:jenkins-core	eq	2.25