REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Jan 30, 2020 | Jan 29, 2020 |
| Jenkins 2020 01 29 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.204.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.219 | Jan 30, 2020 | Jan 29, 2020 |
| Redhat Openshift | — | Upgrade atomic-openshift-service-idlerUpgrade openshift-ansibleUpgrade openshift-kuryrUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-web-consoleUpgrade openshift-enterprise-autohealUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-metrics-serverUpgrade jenkinsUpgrade atomic-openshift-dockerregistryUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-prometheusUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshiftUpgrade atomic-enterprise-service-catalogUpgrade cri-oUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-cluster-autoscalerUpgrade golang-github-prometheus-alertmanagerUpgrade openshift-enterprise-cluster-capacity | Mar 18, 2020 | Jan 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub