Описание
Jenkins Missing Permission Check
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
This is due to an incomplete fix of SECURITY-3495/CVE-2025-27622.
Jenkins 2.504, LTS 2.492.3 requires Computer/Configure permission to copy an agent containing secrets.
Пакеты
org.jenkins-ci.main:jenkins-core
>= 2.500, < 2.504
2.504
org.jenkins-ci.main:jenkins-core
< 2.492.3
2.492.3
Связанные уязвимости
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
Уязвимость сервера автоматизации Jenkins, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации
