GHSA-449q-v4j2-5h8p

ghsaUSosv

Jenkins allows Exposure of Sensitive Information to an Unauthorized Actor

view advisory published 2022-05-13Licence: CC-BY-4.0

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-5320US	medium5.0	2.12% (82nd)	—	2015-11-25
Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain s…

references

External citations — patches, advisories, analysis.

http://rhn.redhat.com/errata/RHSA-2016-0489.htmlWEB
https://access.redhat.com/errata/RHSA-2016:0070WEB
https://github.com/jenkinsci/jenkinsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2015-5320ADVISORY
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan