An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2018 04 11 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.107.2Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.116 | May 3, 2018 | Apr 13, 2018 |
| Redhat Openshift | — | Upgrade nodejs-on-finishedUpgrade jenkins-plugin-blueocean-pipeline-api-implUpgrade rubygem-concurrent-rubyUpgrade nodejs-combined-streamUpgrade python-crontabUpgrade nodejs-brace-expansionUpgrade nodejs-balanced-matchUpgrade nodejs-client-sessionsUpgrade rubygem-httpUpgrade nodejs-is-unc-pathUpgrade rubygem-mime-typesUpgrade python-clickUpgrade jenkins-2-pluginsUpgrade python-ruamel-ordereddictUpgrade nodejs-acceptsUpgrade jenkins-plugin-pipeline-milestone-stepUpgrade jenkins-plugin-ssh-credentialsUpgrade jenkins-plugin-workflow-cps-global-libUpgrade jenkins-plugin-github-branch-sourceUpgrade nodejs-grunt-contrib-cleanUpgrade nodejs-media-typerUpgrade nodejs-chalkUpgrade python-urllib3Upgrade mediawiki-apb-roleUpgrade nodejs-morganUpgrade golang-github-prometheus-prometheusUpgrade rubygem-faradayUpgrade nodejs-underscore-dot-stringUpgrade nodejs-form-dataUpgrade jenkins-plugin-durable-taskUpgrade nodejs-lru-cacheUpgrade python-pysocksUpgrade jenkins-plugin-branch-apiUpgrade nodejs-range-parserUpgrade rubygem-i18nUpgrade nodejs-http-proxyUpgrade cri-oUpgrade jenkins-plugin-githubUpgrade jenkins-plugin-ace-editorUpgrade rubygem-yajl-rubyUpgrade atomic-openshift-metrics-serverUpgrade nodejs-passport-http-bearerUpgrade fluentdUpgrade nodejs-debugUpgrade rubygem-netrcUpgrade nodejs-graceful-readlinkUpgrade nodejs-grunt-contrib-copyUpgrade jenkins-plugin-plain-credentialsUpgrade jenkins-plugin-blueocean-dashboardUpgrade nodejs-forever-agentUpgrade jenkins-plugin-workflow-basic-stepsUpgrade jenkins-plugin-workflow-durable-task-stepUpgrade jenkins-plugin-jquery-detachedUpgrade mediawikiUpgrade jenkins-plugin-handlebarsUpgrade nodejs-forwardedUpgrade openshift-ansibleUpgrade nodejs-escape-string-regexpUpgrade nodejs-ipaddr.jsUpgrade rubygem-elasticsearchUpgrade nodejs-openshift-auth-proxyUpgrade nodejs-boomUpgrade golang-github-prometheus-alertmanagerUpgrade nodejs-hoekUpgrade jenkins-plugin-blueoceanUpgrade jenkins-plugin-cloudbees-folderUpgrade nodejs-isstreamUpgrade elastic-curatorUpgrade nodejs-is-absoluteUpgrade nodejs-serve-staticUpgrade nodejs-iconv-liteUpgrade jenkins-plugin-icon-shimUpgrade jenkins-plugin-blueocean-github-pipelineUpgrade nodejs-grunt-legacy-utilUpgrade rubygem-fluent-mixin-config-placeholdersUpgrade nodejs-is-relativeUpgrade python-kubernetesUpgrade nodejs-oauth-signUpgrade nodejs-url-joinUpgrade jenkins-plugin-workflow-scm-stepUpgrade mysql-apb-roleUpgrade nodejs-base64urlUpgrade elasticsearch-cloud-kubernetesUpgrade nodejs-number-is-nanUpgrade nodejs-mime-dbUpgrade nodejs-passport-oauth2Upgrade nodejs-cookieUpgrade nodejs-object-assignUpgrade jenkins-plugin-jackson2-apiUpgrade nodejs-finalhandlerUpgrade nodejs-core-util-isUpgrade nodejs-eventemitter3Upgrade nodejs-js-yamlUpgrade rubygem-activesupportUpgrade jenkins-plugin-favoriteUpgrade nodejs-concat-mapUpgrade python-typingUpgrade nodejs-sprintf-jsUpgrade jenkins-plugin-workflow-supportUpgrade python-botocoreUpgrade jenkinsUpgrade nodejs-parse-durationUpgrade rubygem-string-scrubUpgrade nodejs-abbrevUpgrade nodejs-content-typeUpgrade jenkins-plugin-mercurialUpgrade nodejs-escape-htmlUpgrade rubygem-fluent-plugin-rewrite-tag-filterUpgrade rubygem-unfUpgrade rubygem-prometheus-clientUpgrade rubygem-http_parser.rbUpgrade nodejs-aws-sign2Upgrade nodejs-repeatingUpgrade nodejs-unpipeUpgrade nodejs-y18nUpgrade nodejs-getobjectUpgrade nodejs-is-propertyUpgrade nodejs-uid2Upgrade nodejs-graceful-fsUpgrade rubygem-kubeclientUpgrade jenkins-plugin-pipeline-rest-apiUpgrade nodejs-image-sizeUpgrade nodejs-meowUpgrade nodejs-grunt-legacy-logUpgrade nodejs-yallistUpgrade jenkins-plugin-mailerUpgrade nodejs-whichUpgrade nodejs-bluebirdUpgrade nodejs-mkdirpUpgrade jenkins-plugin-pipeline-model-declarative-agentUpgrade jenkins-plugin-workflow-jobUpgrade dumb-initUpgrade nodejs-prrUpgrade rubygem-mime-types-dataUpgrade nodejs-grunt-cliUpgrade jenkins-plugin-blueocean-pipeline-editorUpgrade nodejs-grunt-legacy-log-utilsUpgrade rubygem-fluent-plugin-viaq_data_modelUpgrade nodejs-mimeUpgrade nodejs-inheritsUpgrade rubygem-fluent-plugin-prometheusUpgrade python-certifiUpgrade jenkins-plugin-git-serverUpgrade nodejs-readable-streamUpgrade jenkins-plugin-pipeline-input-stepUpgrade nodejs-supports-colorUpgrade nodejs-raw-bodyUpgrade nodejs-isarrayUpgrade nodejs-basic-authUpgrade jenkins-plugin-gitUpgrade nodejs-json-stringify-safeUpgrade jenkins-plugin-script-securityUpgrade nodejs-minimistUpgrade apb-base-scriptsUpgrade nodejs-blUpgrade jenkins-plugin-workflow-step-apiUpgrade rubygem-exconUpgrade image-inspectorUpgrade nodejs-proxy-addrUpgrade rubygem-fluent-plugin-flatten-hashUpgrade jenkins-plugin-metricsUpgrade rubygem-resolve-hostnameUpgrade jenkins-plugin-blueocean-autofavoriteUpgrade jenkins-plugin-blueocean-webUpgrade python-botoUpgrade nodejs-window-sizeUpgrade nodejs-stringstreamUpgrade jenkins-plugin-docker-workflowUpgrade nodejs-hawkUpgrade nodejs-sendUpgrade nodejs-typedarrayUpgrade nodejs-wordwrapUpgrade nodejs-utils-mergeUpgrade nodejs-repeat-stringUpgrade jenkins-plugin-blueocean-i18nUpgrade hawkular-openshift-agentUpgrade nodejs-yargsUpgrade python-boto3Upgrade nodejs-tunnel-agentUpgrade jenkins-plugin-credentialsUpgrade rubygem-uuidtoolsUpgrade nodejs-cookiesUpgrade python-futuresUpgrade nodejs-ansi-regexUpgrade heapsterUpgrade rubygem-minitestUpgrade nodejs-jsonpointerUpgrade atomic-openshift-web-consoleUpgrade nodejs-gruntUpgrade nodejs-requires-portUpgrade jenkins-plugin-pipeline-model-definitionUpgrade openshift-eventrouterUpgrade haproxyUpgrade nodejsUpgrade nodejs-patternflyUpgrade libuvUpgrade rubygem-tzinfo-dataUpgrade rubygem-systemd-journalUpgrade nodejs-minimatchUpgrade rubygem-recursive-open-structUpgrade nodejs-oauthUpgrade jenkins-plugin-workflow-cpsUpgrade atomic-openshift-node-problem-detectorUpgrade jenkins-plugin-blueocean-configUpgrade jenkins-plugin-display-url-apiUpgrade ansible-kubernetes-modulesUpgrade python-google-authUpgrade nodejs-varyUpgrade openshift-enterprise-autohealUpgrade nodejs-requestUpgrade jenkins-plugin-blueocean-commonsUpgrade python-elasticsearchUpgrade nodejs-msUpgrade golang-github-openshift-prometheus-alert-bufferUpgrade jenkins-plugin-openshift-loginUpgrade golang-github-prometheus-node_exporterUpgrade csi-livenessprobeUpgrade jenkins-plugin-pipeline-utility-stepsUpgrade nodejs-camelcase-keysUpgrade atomic-openshift-dockerregistryUpgrade rubygem-multi_jsonUpgrade nodejs-inflightUpgrade nodejs-passport-strategyUpgrade nodejs-has-colorUpgrade openshift-external-storageUpgrade nodejs-ee-firstUpgrade cri-toolsUpgrade nodejs-cryptilesUpgrade jenkins-plugin-pubsub-lightUpgrade nodejs-has-ansiUpgrade nodejs-argparseUpgrade nodejs-source-mapUpgrade jenkins-plugin-mapdb-apiUpgrade nodejs-parseurlUpgrade rubygem-rest-clientUpgrade jenkins-plugin-blueocean-rest-implUpgrade nodejs-destroyUpgrade python-openshiftUpgrade rubygem-msgpackUpgrade nodejs-promiseUpgrade cockpitUpgrade nodejs-content-dispositionUpgrade nodejs-caselessUpgrade python-dockerUpgrade nodejs-keygripUpgrade jenkins-plugin-junitUpgrade jenkins-plugin-pipeline-stage-tags-metadataUpgrade atomic-openshift-deschedulerUpgrade nodejs-esprimaUpgrade jenkins-plugin-blueocean-personalizationUpgrade nodejs-path-is-absoluteUpgrade openshift-enterprise-cluster-capacityUpgrade nodejs-eventemitter2Upgrade nodejs-noptUpgrade rubygem-elasticsearch-transportUpgrade nodejs-xtendUpgrade google-cloud-sdkUpgrade python-string_utilsUpgrade nodejs-concat-streamUpgrade nodejs-lcidUpgrade rubygem-addressableUpgrade mediawiki-container-scriptsUpgrade ansible-service-brokerUpgrade jenkins-plugin-authentication-tokensUpgrade nodejs-colorsUpgrade rubygem-public_suffixUpgrade nodejs-bytesUpgrade nodejs-node-uuidUpgrade nodejs-generate-object-propertyUpgrade jenkins-plugin-blueocean-git-pipelineUpgrade rubygem-http-form_dataUpgrade nodejs-packagingUpgrade rubygem-fluent-plugin-record-modifierUpgrade jenkins-plugin-matrix-authUpgrade thriftUpgrade nodejs-pseudomapUpgrade rubygem-fluent-plugin-remote-syslogUpgrade nodejs-align-textUpgrade nodejs-is-windowsUpgrade mariadb-apb-roleUpgrade nodejs-cliuiUpgrade jenkins-plugin-pipeline-stage-stepUpgrade nodejs-lodashUpgrade rubygem-thread_safeUpgrade postgresql-apb-roleUpgrade nodejs-expressUpgrade nodejs-camelcaseUpgrade nodejs-asyncUpgrade nodejs-tough-cookieUpgrade nodejs-kind-ofUpgrade csi-attacherUpgrade atomic-openshiftUpgrade jenkins-plugin-workflow-remote-loaderUpgrade nodejs-is-my-json-validUpgrade nodejs-os-localeUpgrade nodejs-qsUpgrade rubygem-lru_reduxUpgrade nodejs-right-alignUpgrade rubygem-fluent-plugin-docker_metadata_filterUpgrade python-dictdifferUpgrade jenkins-plugin-pipeline-model-extensionsUpgrade nodejs-passportUpgrade nodejs-type-isUpgrade jenkins-plugin-variantUpgrade nodejs-rimrafUpgrade nodejs-on-headersUpgrade nodejs-pauseUpgrade rubygem-elasticsearch-apiUpgrade jenkins-plugin-pipeline-graph-analysisUpgrade nodejs-http-signatureUpgrade jenkins-plugin-workflow-apiUpgrade rubygem-fluent-plugin-secure-forwardUpgrade rubygem-unf_extUpgrade jenkins-plugin-multiple-scmsUpgrade nodejs-extendUpgrade nodejs-is-finiteUpgrade jenkins-plugin-git-clientUpgrade nodejs-resolveUpgrade golang-github-openshift-oauth-proxyUpgrade rubygem-sigdumpUpgrade nodejs-negotiatorUpgrade rubygem-docker-apiUpgrade nodejs-indent-stringUpgrade jenkins-plugin-blueocean-display-urlUpgrade jenkins-plugin-kubernetesUpgrade jenkins-plugin-credentials-bindingUpgrade jenkins-plugin-openshift-clientUpgrade nodejs-sntpUpgrade nodejs-util-deprecateUpgrade python-mockUpgrade jenkins-plugin-pipeline-stage-viewUpgrade jenkins-plugin-blueocean-eventsUpgrade nodejs-statusesUpgrade nodejs-string_decoderUpgrade nodejs-hookerUpgrade nodejs-onceUpgrade golang-github-prometheus-promuUpgrade nodejs-center-alignUpgrade nodejs-generate-functionUpgrade jenkins-plugin-workflow-multibranchUpgrade nodejs-process-nextick-argsUpgrade jenkins-plugin-openshift-syncUpgrade nodejs-commanderUpgrade nodejs-longestUpgrade nodejs-findup-syncUpgrade rubygem-fluent-plugin-kubernetes_metadata_filterUpgrade python-s3transferUpgrade elasticsearchUpgrade python-rsaUpgrade nodejs-globUpgrade jenkins-plugin-docker-commonsUpgrade rubygem-fluent-plugin-elasticsearchUpgrade jenkins-plugin-token-macroUpgrade nodejs-asn1Upgrade nodejs-errnoUpgrade rubygem-syslog_protocolUpgrade nodejs-assert-plusUpgrade atomic-enterprise-service-catalogUpgrade nodejs-decamelizeUpgrade nodejs-has-flagUpgrade ansible-asb-modulesUpgrade nodejs-invert-kvUpgrade nodejs-har-validatorUpgrade rubygem-http-cookieUpgrade nodejs-delayed-streamUpgrade jenkins-plugin-pipeline-build-stepUpgrade nodejs-http-errorsUpgrade rubygem-tzinfoUpgrade rubygem-proxifierUpgrade rubygem-domain_nameUpgrade nodejs-coffee-scriptUpgrade nodejs-mime-typesUpgrade csi-provisionerUpgrade apbUpgrade jenkins-plugin-sse-gatewayUpgrade python-ruamel-yamlUpgrade nodejs-exitUpgrade nodejs-freshUpgrade csi-driver-registrarUpgrade jenkins-plugin-subversionUpgrade imagebuilderUpgrade nodejs-wrappyUpgrade python-cachetoolsUpgrade nodejs-amdefineUpgrade jenkins-plugin-openshift-pipelineUpgrade jenkins-plugin-pipeline-model-apiUpgrade openshift-elasticsearch-pluginUpgrade jenkins-plugin-workflow-aggregatorUpgrade nodejs-path-to-regexpUpgrade jenkins-plugin-matrix-projectUpgrade rubygem-quantileUpgrade jenkins-plugin-momentjsUpgrade jenkins-plugin-github-apiUpgrade jenkins-plugin-structsUpgrade nodejs-asapUpgrade nodejs-lessUpgrade nodejs-file-sync-cmpUpgrade rubygem-fluent-plugin-systemdUpgrade nodejs-array-flattenUpgrade nodejs-etagUpgrade nodejs-merge-descriptorsUpgrade rubygem-cool.ioUpgrade jenkins-plugin-scm-apiUpgrade rubygem-multipart-postUpgrade nodejs-ansi-stylesUpgrade nodejs-strip-ansiUpgrade nodejs-cookie-signatureUpgrade nodejs-depdUpgrade nodejs-body-parserUpgrade nodejs-ctypeUpgrade jenkins-plugin-blueocean-jwtUpgrade kibanaUpgrade jenkins-plugin-blueocean-restUpgrade nodejs-map-objUpgrade nodejs-is-bufferUpgrade nodejs-grunt-contrib-lessUpgrade nodejs-methodsUpgrade nodejs-unc-path-regexUpgrade nodejs-dateformatUpgrade atomic-openshift-cluster-autoscalerUpgrade rubygem-ffi | Aug 6, 2019 | Apr 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub