Описание
A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
Ссылки
- Vendor Advisory
- PatchThird Party Advisory
- Vendor Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.120 (включая)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
Конфигурация 2Версия до 2.107.2 (включая)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
Конфигурация 3
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*
EPSS
Процентиль: 64%
0.00479
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 4.3
redhat
больше 7 лет назад
A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
CVSS3: 4.3
github
больше 3 лет назад
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
EPSS
Процентиль: 64%
0.00479
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
NVD-CWE-noinfo