Description
Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | jenkins | jenkins 2.44, jenkins 2.32.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.32.2 | 2.32.2 | GHSA-6967-9vvv-4cmm |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.34, < 2.44 | 2.44 | GHSA-6967-9vvv-4cmm |