Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Jan 30, 2020 | Jan 29, 2020 |
| Jenkins 2020 01 29 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.204.2Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.219 | Jan 30, 2020 | Jan 29, 2020 |
| Redhat Openshift | — | Upgrade atomic-openshift-deschedulerUpgrade atomic-openshiftUpgrade atomic-openshift-web-consoleUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-cluster-autoscalerUpgrade jenkins-2-pluginsUpgrade golang-github-openshift-oauth-proxyUpgrade openshift-kuryrUpgrade atomic-enterprise-service-catalogUpgrade cri-oUpgrade atomic-openshift-metrics-serverUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-node-problem-detectorUpgrade openshift-ansibleUpgrade openshift-enterprise-autohealUpgrade jenkinsUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-service-idlerUpgrade golang-github-prometheus-alertmanager | Mar 18, 2020 | Jan 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub