GHSA-v222-w2mw-xjc6

ghsaUSosv

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

view advisory published 2022-05-13Licence: CC-BY-4.0

jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-2609US	medium4.3	1.73% (78th)	—	2018-05-22
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discl…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/95964WEB
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2609WEB
https://github.com/jenkinsci/jenkinsPACKAGE
https://github.com/jenkinsci/jenkins/commit/13905d8224899ba7332fe9af4e330ea96a2ae319WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-2609ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan