DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Jenkins: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-03-08
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen und Code auszuführen
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-27905US | critical9.6 | — | ||
Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS)… | ||||
| CVE-2023-27904US | medium5.3 | — | ||
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jen… | ||||
| CVE-2023-27903US | medium4.4OT erhöht | — | ||
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a… | ||||
| CVE-2023-27902US | medium4.3OT erhöht | — | ||
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their cont… | ||||
| CVE-2023-27901US | high7.5 | — | ||
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 fo… | ||||
| CVE-2023-27900US | high7.5 | — | ||
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 fo… | ||||
| CVE-2023-27899US | high7.0OT erhöht | — | ||
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a… | ||||
| CVE-2023-27898US | critical9.6 | — | ||
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message… | ||||
| CVE-2023-24998US | high7.5 | Exploit | ||
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2023:1655 vom 2023-04-12external
- Red Hat Security Advisory RHSA-2023:3195 vom 2023-05-19external
- Red Hat Security Advisory RHSA-2023:3198 vom 2023-05-18external
- Red Hat Security Advisory RHSA-2023:3299 vom 2023-05-24external
- Red Hat Security Advisory RHSA-2023:3622 vom 2023-06-15external
- Red Hat Security Advisory RHSA-2023:3663 vom 2023-06-19external
- Red Hat Security Advisory RHSA-2024:0775 vom 2024-02-12external
- Red Hat Security Advisory RHSA-2024:0778 vom 2024-02-12external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan