Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Sep 25, 2023 | Sep 25, 2023 |
| Jenkins 2023 09 20 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.424Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.414.2 | Sep 21, 2023 | Sep 20, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub