Summary
Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen offenzulegen.
Product
Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.
Vulnerabilities 3
-
Medium 4.3
Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller fil…
-
Medium 4.3
Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
-
Low 3.1
Exposure of secrets through system log in Jenkins Structs Plugin
When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secret…
Revision history
-
#1
Initiale Fassung
References
-
Jenkins Security Advisory vom 2024-06-26
https://www.jenkins.io/security/advisory/2024-06-26/