The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins to version 1.638Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 1.625.2Upgrade Jenkins LTS to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-prepend-httpUpgrade nodejs-semver-diffUpgrade nodejs-anymatchUpgrade nodejs-update-notifierUpgrade nodejs-is-dotfileUpgrade heapsterUpgrade nodejs-is-binary-pathUpgrade nodejs-optimistUpgrade nodejs-unzip-responseUpgrade nss_wrapperUpgrade openshift-origin-node-proxyUpgrade nodejs-glob-parentUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-fill-rangeUpgrade phpUpgrade nodejs-arr-flattenUpgrade nodejs-end-of-streamUpgrade nodejs-lodash.basecopyUpgrade nodejs-lodash.isarrayUpgrade openshift-origin-broker-utilUpgrade nodejs-lodash.restparamUpgrade nodejs-pinkie-promiseUpgrade nodejs-pinkieUpgrade nodejs-binary-extensionsUpgrade nodejs-is-globUpgrade nodejs-lodash.keysUpgrade nodejs-isobjectUpgrade nodejs-is-numberUpgrade nodejs-lazy-cacheUpgrade openshift-enterprise-upgradeUpgrade nodejs-micromatchUpgrade nodejs-for-ownUpgrade nodejs-bracesUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-iniUpgrade nodejs-ansi-wrapUpgrade nodejs-create-error-classUpgrade nodejs-string-lengthUpgrade nodejs-stream-combinerUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-normalize-pathUpgrade openshift-origin-cartridge-cronUpgrade jenkinsUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-deep-extendUpgrade nodejs-graceful-fsUpgrade nodejs-throughUpgrade nodejs-lodash.isargumentsUpgrade activemqUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-equal-shallowUpgrade nodejs-strip-json-commentsUpgrade nodejs-os-homedirUpgrade nodejs-is-streamUpgrade nodejs-undefsafeUpgrade nodejs-slideUpgrade openshift-origin-node-utilUpgrade nodejs-registry-urlUpgrade nodejs-glob-baseUpgrade nodejs-touchUpgrade nodejs-is-npmUpgrade nodejs-duplexifyUpgrade nodejs-gotUpgrade nodejs-splitUpgrade nodejs-uuidUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-configstoreUpgrade rubygem-openshift-origin-commonUpgrade nodejs-lodash.baseassignUpgrade nodejs-preserveUpgrade openshift-origin-cartridge-phpUpgrade nodejs-pause-streamUpgrade nodejs-arrifyUpgrade nodejs-capture-stack-traceUpgrade nodejs-filename-regexUpgrade nodejs-align-textUpgrade nodejs-fromUpgrade nodejs-object.omitUpgrade nodejs-semverUpgrade nodejs-async-eachUpgrade nodejs-event-streamUpgrade nodejs-array-uniqueUpgrade nodejs-os-tmpdirUpgrade nodejs-arr-diffUpgrade nodejs-randomaticUpgrade nodejs-parse-globUpgrade nodejs-is-extendableUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-kind-ofUpgrade nodejs-mkdirpUpgrade nodejs-expand-bracketsUpgrade nodejs-readdirpUpgrade nodejs-parse-jsonUpgrade nodejs-osenvUpgrade nodejs-map-streamUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-lowercase-keysUpgrade nodejs-write-file-atomicUpgrade openvswitchUpgrade nodejs-is-primitiveUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-xdg-basedirUpgrade openshift-ansibleUpgrade nodejs-repeat-elementUpgrade nodejs-node-status-codesUpgrade nodejs-duplexerUpgrade atomic-openshiftUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-read-all-streamUpgrade nodejs-es6-promiseUpgrade nodejs-expand-rangeUpgrade rhcUpgrade nodejs-chokidarUpgrade nodejs-package-jsonUpgrade origin-kibanaUpgrade nodejs-is-extglobUpgrade nodejs-rcUpgrade nodejs-for-inUpgrade nodejs-extglobUpgrade nodejs-is-plain-objUpgrade nodejs-success-symbolUpgrade nodejs-lodash.defaultsUpgrade nodejs-url-parse-laxUpgrade nodejs-lodash.createassignerUpgrade nodejs-ansi-greenUpgrade nodejs-error-exUpgrade nodejs-ps-treeUpgrade nodejs-regex-cacheUpgrade nodejs-lodash.assignUpgrade nodejs-object-assignUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-timed-outUpgrade nodejs-is-redirectUpgrade nodejs-latest-versionUpgrade nodejs-nodemon | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub