Summary
Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren sowie Cross-Site-Scripting- (XSS) oder Server-Side-Request-Forgery- (SSRF) Angriffe durchzuführen.
Product
Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.
Vulnerabilities 23
-
Critical 9.0
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS …
-
High 8.8
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with S…
-
High 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows att…
-
High 8.1
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsisten…
-
High 7.1
Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attack…
-
Medium 6.5
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking app…
-
Medium 5.4
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in …
-
Medium 5.4
Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pa…
-
Medium 4.3
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names d…
-
Medium 4.3
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file p…
-
Medium 4.3
Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission …
-
Medium 4.3
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or …
-
Medium 4.3
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overa…
-
Medium 4.3
Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credent…
-
Medium 4.3
Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials look…
-
Medium 4.3
A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Over…
-
Medium 4.3
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permissi…
-
Medium 4.3
Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to…
-
Medium 4.3
Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission…
-
Medium 4.2
A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to …
-
Medium 4.2
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permissi…
-
Low 3.7
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time compariso…
-
Low 2.7
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as p…
Revision history
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Jenkins Security Advisory vom 2026-08-05
https://www.jenkins.io/security/advisory/2026-08-05/
-
Red Hat Security Advisory RHSA-2026:60254 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60254
-
Red Hat Security Advisory RHSA-2026:60246 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60246
-
Red Hat Security Advisory RHSA-2026:60256 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60256
-
Red Hat Security Advisory RHSA-2026:60251 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60251
-
Red Hat Security Advisory RHSA-2026:60247 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60247
-
Red Hat Security Advisory RHSA-2026:60248 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60248
-
Red Hat Security Advisory RHSA-2026:60249 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60249
-
Red Hat Security Advisory RHSA-2026:60250 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60250
-
Red Hat Security Advisory RHSA-2026:60252 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60252
-
Red Hat Security Advisory RHSA-2026:60239 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60239
-
Red Hat Security Advisory RHSA-2026:60259 vom 2026-08-26
https://access.redhat.com/errata/RHSA-2026:60259