Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-jenkins | Aug 22, 2024 | Apr 7, 2021 | |
| Jenkins 2021 04 07 | jenkins-lts-upgrade-2_277_2jenkins-upgrade-2_287 | Dec 2, 2021 | Apr 7, 2021 | |
| Redhat Openshift | linuxrpm-upgrade-jenkins | May 21, 2021 | Apr 7, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub