An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2018 04 11 | — | Upgrade Jenkins to version 2.116Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.107.2 | May 3, 2018 | Apr 13, 2018 |
| Redhat Openshift | — | Upgrade nodejs-delayed-streamUpgrade rubygem-fluent-plugin-record-modifierUpgrade jenkins-plugin-token-macroUpgrade nodejs-source-mapUpgrade rubygem-elasticsearch-apiUpgrade nodejs-etagUpgrade nodejs-colorsUpgrade nodejs-decamelizeUpgrade rubygem-elasticsearch-transportUpgrade jenkins-plugin-openshift-clientUpgrade python-openshiftUpgrade golang-github-openshift-oauth-proxyUpgrade nodejs-asapUpgrade jenkins-plugin-openshift-syncUpgrade nodejs-statusesUpgrade jenkins-plugin-kubernetesUpgrade nodejs-path-to-regexpUpgrade nodejs-merge-descriptorsUpgrade jenkins-plugin-subversionUpgrade nodejs-packagingUpgrade python-dictdifferUpgrade jenkins-plugin-variantUpgrade rubygem-multipart-postUpgrade jenkins-plugin-mapdb-apiUpgrade jenkins-plugin-workflow-aggregatorUpgrade jenkins-plugin-junitUpgrade nodejs-lessUpgrade csi-attacherUpgrade nodejs-camelcaseUpgrade nodejs-globUpgrade nodejs-kind-ofUpgrade nodejs-lodashUpgrade nodejs-ee-firstUpgrade nodejs-strip-ansiUpgrade nodejs-methodsUpgrade nodejs-grunt-contrib-lessUpgrade nodejs-http-signatureUpgrade nodejs-on-headersUpgrade jenkins-plugin-openshift-pipelineUpgrade nodejs-center-alignUpgrade nodejs-array-flattenUpgrade nodejs-util-deprecateUpgrade nodejs-expressUpgrade nodejs-file-sync-cmpUpgrade nodejs-tough-cookieUpgrade nodejs-concat-streamUpgrade jenkins-plugin-multiple-scmsUpgrade nodejs-type-isUpgrade jenkins-plugin-scm-apiUpgrade nodejs-hookerUpgrade nodejs-exitUpgrade nodejs-depdUpgrade nodejs-mime-typesUpgrade jenkins-plugin-workflow-multibranchUpgrade nodejs-string_decoderUpgrade jenkins-plugin-docker-commonsUpgrade nodejs-invert-kvUpgrade nodejs-ansi-stylesUpgrade apbUpgrade nodejs-promiseUpgrade atomic-openshiftUpgrade jenkins-plugin-workflow-apiUpgrade nodejs-asn1Upgrade nodejs-is-my-json-validUpgrade jenkins-plugin-matrix-authUpgrade atomic-openshift-cluster-autoscalerUpgrade nodejs-is-bufferUpgrade jenkins-plugin-structsUpgrade nodejs-unc-path-regexUpgrade rubygem-http-cookieUpgrade nodejs-longestUpgrade rubygem-http-form_dataUpgrade jenkins-plugin-authentication-tokensUpgrade atomic-openshift-deschedulerUpgrade jenkins-plugin-sse-gatewayUpgrade nodejs-ctypeUpgrade nodejs-passportUpgrade nodejs-commanderUpgrade postgresql-apb-roleUpgrade rubygem-tzinfoUpgrade nodejs-os-localeUpgrade rubygem-fluent-plugin-kubernetes_metadata_filterUpgrade jenkins-plugin-blueocean-eventsUpgrade nodejs-bytesUpgrade nodejs-path-is-absoluteUpgrade jenkins-plugin-momentjsUpgrade nodejs-onceUpgrade nodejs-resolveUpgrade nodejs-right-alignUpgrade jenkins-plugin-credentials-bindingUpgrade nodejs-dateformatUpgrade nodejs-keygripUpgrade nodejs-has-ansiUpgrade jenkins-plugin-pipeline-model-extensionsUpgrade nodejs-eventemitter2Upgrade jenkins-plugin-blueocean-git-pipelineUpgrade nodejs-caselessUpgrade jenkins-plugin-pipeline-build-stepUpgrade python-ruamel-yamlUpgrade nodejs-extendUpgrade rubygem-fluent-plugin-systemdUpgrade nodejs-http-errorsUpgrade openshift-elasticsearch-pluginUpgrade rubygem-quantileUpgrade python-s3transferUpgrade nodejs-is-finiteUpgrade rubygem-ffiUpgrade rubygem-fluent-plugin-secure-forwardUpgrade csi-provisionerUpgrade jenkins-plugin-matrix-projectUpgrade jenkins-plugin-blueocean-personalizationUpgrade rubygem-public_suffixUpgrade elasticsearchUpgrade nodejs-generate-object-propertyUpgrade mariadb-apb-roleUpgrade nodejs-errnoUpgrade rubygem-fluent-plugin-remote-syslogUpgrade nodejs-is-windowsUpgrade nodejs-qsUpgrade nodejs-assert-plusUpgrade atomic-enterprise-service-catalogUpgrade google-cloud-sdkUpgrade kibanaUpgrade nodejs-har-validatorUpgrade nodejs-amdefineUpgrade nodejs-body-parserUpgrade thriftUpgrade python-cachetoolsUpgrade mediawiki-container-scriptsUpgrade rubygem-fluent-plugin-elasticsearchUpgrade rubygem-cool.ioUpgrade nodejs-align-textUpgrade nodejs-asyncUpgrade nodejs-pseudomapUpgrade jenkins-plugin-workflow-remote-loaderUpgrade nodejs-has-flagUpgrade jenkins-plugin-pubsub-lightUpgrade nodejs-rimrafUpgrade rubygem-rest-clientUpgrade cockpitUpgrade nodejs-xtendUpgrade rubygem-syslog_protocolUpgrade jenkins-plugin-github-apiUpgrade nodejs-generate-functionUpgrade nodejs-pauseUpgrade python-rsaUpgrade rubygem-lru_reduxUpgrade rubygem-fluent-plugin-docker_metadata_filterUpgrade jenkins-plugin-blueocean-jwtUpgrade rubygem-domain_nameUpgrade nodejs-node-uuidUpgrade nodejs-content-dispositionUpgrade ansible-service-brokerUpgrade jenkins-plugin-pipeline-graph-analysisUpgrade nodejs-process-nextick-argsUpgrade nodejs-parseurlUpgrade nodejs-indent-stringUpgrade ansible-asb-modulesUpgrade golang-github-prometheus-promuUpgrade jenkins-plugin-pipeline-stage-stepUpgrade nodejs-findup-syncUpgrade nodejs-wrappyUpgrade rubygem-addressableUpgrade rubygem-proxifierUpgrade imagebuilderUpgrade csi-driver-registrarUpgrade nodejs-coffee-scriptUpgrade rubygem-unf_extUpgrade python-dockerUpgrade jenkins-plugin-git-clientUpgrade nodejs-cliuiUpgrade rubygem-sigdumpUpgrade nodejs-cryptilesUpgrade rubygem-thread_safeUpgrade python-string_utilsUpgrade nodejs-map-objUpgrade nodejs-lcidUpgrade jenkins-plugin-blueocean-restUpgrade jenkins-plugin-blueocean-rest-implUpgrade openshift-enterprise-cluster-capacityUpgrade nodejs-esprimaUpgrade python-mockUpgrade nodejs-freshUpgrade nodejs-destroyUpgrade jenkins-plugin-pipeline-model-apiUpgrade rubygem-msgpackUpgrade nodejs-sntpUpgrade jenkins-plugin-pipeline-stage-viewUpgrade rubygem-docker-apiUpgrade cri-toolsUpgrade nodejs-argparseUpgrade nodejs-cookie-signatureUpgrade nodejs-noptUpgrade jenkins-plugin-pipeline-stage-tags-metadataUpgrade nodejs-negotiatorUpgrade jenkins-plugin-blueocean-display-urlUpgrade nodejs-on-finishedUpgrade rubygem-httpUpgrade rubygem-fluent-plugin-rewrite-tag-filterUpgrade nodejs-forever-agentUpgrade nodejs-varyUpgrade jenkins-plugin-jquery-detachedUpgrade rubygem-fluent-plugin-prometheusUpgrade rubygem-unfUpgrade nodejs-grunt-contrib-cleanUpgrade nodejs-inflightUpgrade nodejs-concat-mapUpgrade nodejs-sendUpgrade jenkins-plugin-blueocean-dashboardUpgrade jenkins-plugin-workflow-durable-task-stepUpgrade nodejs-camelcase-keysUpgrade openshift-external-storageUpgrade golang-github-prometheus-node_exporterUpgrade nodejs-http-proxyUpgrade nodejs-range-parserUpgrade rubygem-faradayUpgrade nodejs-requires-portUpgrade nodejs-minimistUpgrade nodejs-acceptsUpgrade atomic-openshift-node-problem-detectorUpgrade nodejs-patternflyUpgrade jenkins-plugin-workflow-step-apiUpgrade jenkins-plugin-plain-credentialsUpgrade nodejs-underscore-dot-stringUpgrade mediawikiUpgrade ansible-kubernetes-modulesUpgrade jenkins-2-pluginsUpgrade nodejs-blUpgrade rubygem-mime-typesUpgrade csi-livenessprobeUpgrade nodejs-passport-strategyUpgrade jenkins-plugin-pipeline-model-definitionUpgrade image-inspectorUpgrade jenkins-plugin-pipeline-milestone-stepUpgrade rubygem-systemd-journalUpgrade jenkins-plugin-ace-editorUpgrade jenkins-plugin-metricsUpgrade rubygem-string-scrubUpgrade python-google-authUpgrade nodejs-sprintf-jsUpgrade jenkins-plugin-blueocean-commonsUpgrade jenkins-plugin-script-securityUpgrade nodejs-parse-durationUpgrade python-ruamel-ordereddictUpgrade nodejs-combined-streamUpgrade jenkins-plugin-branch-apiUpgrade jenkins-plugin-workflow-scm-stepUpgrade nodejs-raw-bodyUpgrade nodejs-eventemitter3Upgrade nodejs-grunt-contrib-copyUpgrade rubygem-fluent-plugin-flatten-hashUpgrade nodejs-cookieUpgrade nodejs-supports-colorUpgrade nodejs-tunnel-agentUpgrade nodejs-finalhandlerUpgrade nodejs-base64urlUpgrade nodejs-graceful-fsUpgrade jenkins-plugin-favoriteUpgrade nodejs-repeat-stringUpgrade openshift-enterprise-autohealUpgrade nodejs-oauthUpgrade jenkins-plugin-cloudbees-folderUpgrade nodejs-ipaddr.jsUpgrade nodejs-getobjectUpgrade jenkins-plugin-credentialsUpgrade nodejs-inheritsUpgrade jenkins-plugin-workflow-supportUpgrade jenkins-plugin-handlebarsUpgrade nodejs-image-sizeUpgrade nodejs-graceful-readlinkUpgrade apb-base-scriptsUpgrade jenkins-plugin-github-branch-sourceUpgrade nodejs-basic-authUpgrade golang-github-prometheus-prometheusUpgrade nodejs-form-dataUpgrade jenkins-plugin-blueocean-configUpgrade atomic-openshift-metrics-serverUpgrade rubygem-exconUpgrade mediawiki-apb-roleUpgrade nodejs-morganUpgrade jenkins-plugin-pipeline-rest-apiUpgrade jenkins-plugin-blueocean-i18nUpgrade nodejs-number-is-nanUpgrade jenkins-plugin-mailerUpgrade jenkins-plugin-openshift-loginUpgrade openshift-eventrouterUpgrade nodejs-grunt-legacy-logUpgrade jenkins-plugin-workflow-cpsUpgrade nodejs-object-assignUpgrade jenkins-plugin-blueocean-webUpgrade nodejs-uid2Upgrade nodejs-isarrayUpgrade nodejs-mkdirpUpgrade jenkins-plugin-docker-workflowUpgrade nodejs-grunt-cliUpgrade nodejs-typedarrayUpgrade nodejs-balanced-matchUpgrade jenkins-plugin-display-url-apiUpgrade rubygem-tzinfo-dataUpgrade haproxyUpgrade python-urllib3Upgrade jenkins-plugin-ssh-credentialsUpgrade nodejs-yargsUpgrade nodejs-client-sessionsUpgrade nodejs-lru-cacheUpgrade nodejs-aws-sign2Upgrade rubygem-activesupportUpgrade python-crontabUpgrade rubygem-multi_jsonUpgrade nodejs-escape-string-regexpUpgrade nodejs-openshift-auth-proxyUpgrade nodejs-meowUpgrade nodejs-ansi-regexUpgrade jenkins-plugin-blueoceanUpgrade nodejs-passport-oauth2Upgrade nodejs-prrUpgrade nodejs-minimatchUpgrade nodejs-abbrevUpgrade jenkins-plugin-githubUpgrade jenkins-plugin-gitUpgrade nodejs-utils-mergeUpgrade jenkins-plugin-pipeline-model-declarative-agentUpgrade nodejs-brace-expansionUpgrade golang-github-prometheus-alertmanagerUpgrade rubygem-resolve-hostnameUpgrade python-botoUpgrade nodejs-bluebirdUpgrade nodejs-cookiesUpgrade python-elasticsearchUpgrade atomic-openshift-dockerregistryUpgrade nodejs-msUpgrade nodejs-repeatingUpgrade rubygem-concurrent-rubyUpgrade jenkins-plugin-blueocean-pipeline-api-implUpgrade rubygem-kubeclientUpgrade nodejs-hawkUpgrade nodejs-stringstreamUpgrade nodejs-window-sizeUpgrade nodejs-grunt-legacy-utilUpgrade hawkular-openshift-agentUpgrade cri-oUpgrade rubygem-recursive-open-structUpgrade elasticsearch-cloud-kubernetesUpgrade rubygem-mime-types-dataUpgrade nodejs-mimeUpgrade jenkins-plugin-jackson2-apiUpgrade python-boto3Upgrade jenkins-plugin-workflow-basic-stepsUpgrade nodejs-yallistUpgrade nodejs-is-propertyUpgrade rubygem-minitestUpgrade mysql-apb-roleUpgrade jenkins-plugin-workflow-jobUpgrade nodejs-grunt-legacy-log-utilsUpgrade nodejsUpgrade nodejs-readable-streamUpgrade nodejs-json-stringify-safeUpgrade nodejs-wordwrapUpgrade jenkins-plugin-workflow-cps-global-libUpgrade nodejs-debugUpgrade nodejs-chalkUpgrade nodejs-is-unc-pathUpgrade nodejs-gruntUpgrade nodejs-boomUpgrade python-clickUpgrade rubygem-i18nUpgrade nodejs-isstreamUpgrade rubygem-elasticsearchUpgrade jenkinsUpgrade nodejs-mime-dbUpgrade nodejs-jsonpointerUpgrade nodejs-is-absoluteUpgrade python-pysocksUpgrade rubygem-http_parser.rbUpgrade nodejs-js-yamlUpgrade nodejs-core-util-isUpgrade nodejs-forwardedUpgrade rubygem-prometheus-clientUpgrade nodejs-media-typerUpgrade jenkins-plugin-durable-taskUpgrade nodejs-has-colorUpgrade nodejs-oauth-signUpgrade jenkins-plugin-blueocean-autofavoriteUpgrade openshift-ansibleUpgrade rubygem-netrcUpgrade rubygem-uuidtoolsUpgrade rubygem-fluent-plugin-viaq_data_modelUpgrade golang-github-openshift-prometheus-alert-bufferUpgrade nodejs-proxy-addrUpgrade jenkins-plugin-pipeline-utility-stepsUpgrade nodejs-requestUpgrade python-futuresUpgrade heapsterUpgrade libuvUpgrade jenkins-plugin-pipeline-input-stepUpgrade atomic-openshift-web-consoleUpgrade nodejs-passport-http-bearerUpgrade nodejs-unpipeUpgrade python-typingUpgrade nodejs-escape-htmlUpgrade elastic-curatorUpgrade jenkins-plugin-blueocean-pipeline-editorUpgrade jenkins-plugin-blueocean-github-pipelineUpgrade nodejs-whichUpgrade nodejs-iconv-liteUpgrade nodejs-content-typeUpgrade nodejs-serve-staticUpgrade dumb-initUpgrade python-kubernetesUpgrade nodejs-is-relativeUpgrade jenkins-plugin-icon-shimUpgrade python-botocoreUpgrade nodejs-y18nUpgrade nodejs-url-joinUpgrade jenkins-plugin-mercurialUpgrade rubygem-yajl-rubyUpgrade fluentdUpgrade python-certifiUpgrade nodejs-hoekUpgrade rubygem-fluent-mixin-config-placeholdersUpgrade jenkins-plugin-git-server | Aug 6, 2019 | Apr 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub