Description
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.335 – < unspecified, unspecified – ≤ 2.355 | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.335, < 2.356 | 2.356 | GHSA-p3rc-946h-8cf5 |
Advisories 1
- WID-SEC-2022-0445 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 22, 2023