WID-SEC-W-2024-1018

DeutschShown in its original language — a full translation is planned for a future version.

Jenkins: Mehrere Schwachstellen

view advisory published 2024-05-02

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code im Kontext des Dienstes auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

describes (5)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-34148US	—	0.79% (56th)	—	2024-05-02
Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting…
CVE-2024-34147US	—	0.52% (44th)	—	2024-05-02
Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users w…
CVE-2024-34146US	—OT elevated	0.52% (44th)	—	2024-05-02
Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers with a previously conf…
CVE-2024-34145US	—	1.00% (63rd)	—	2024-05-02
A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier…
CVE-2024-34144US	—	48.4% (99th)	Exploit	2024-05-02
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and…

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan