DeutschShown in its original language — a full translation is planned for a future version.
Jenkins: Mehrere Schwachstellen
view advisory published 2024-10-03
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Jenkins und verschiedenen Jenkins Plugins ausnutzen, um Informationen offenzulegen Sicherheitsvorkehrungen zu umgehen oder seine Rechte zu erweitern.
01
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-47807US | — | — | ||
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authenticati… | ||||
| CVE-2024-47806US | — | — | ||
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentica… | ||||
| CVE-2024-47805US | high7.5 | — | ||
Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when ac… | ||||
| CVE-2024-47804US | medium4.3OT elevated | — | ||
If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST… | ||||
| CVE-2024-47803US | medium4.3 | — | ||
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form fie… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2024:8884 vom 2024-11-05external
- Red Hat Security Advisory RHSA-2024:8885 vom 2024-11-05external
- Red Hat Security Advisory RHSA-2024:8886 vom 2024-11-05external
- Red Hat Security Advisory RHSA-2024:8887 vom 2024-11-05external
- WID-SEC-W-2024-3071 - CSAF Versionself
- WID-SEC-2024-3071 - Portal Versionself
- Jenkins Security Advisory 2024-10-02 vom 2024-10-03external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan