Описание
Jenkins is missing a permission check in the authenticated users' profile menu
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
Jenkins 2.528, LTS 2.516.3 requires Overall/Read permission to list various items in authenticated user profile dropdown menus.
Пакеты
org.jenkins-ci.main:jenkins-core
< 2.516.3
2.516.3
org.jenkins-ci.main:jenkins-core
>= 2.517, < 2.528
2.528
Связанные уязвимости
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
Уязвимость сервера автоматизации Jenkins, позволяющая нарушителю получить несанкционированный доступ к функциям, которые в противном случае были бы ограничены
