Exposure of Jenkins

CI
44
exposure score
14
sites use
1
exploited
3
critical

CVEs

174 results
CVE-2023-27898CRITICALJenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depeEPSS 1.8%CVE-2017-2606MEDIUMJenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that shouEPSS 1.8%CVE-2021-21671—Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.EPSS 1.8%CVE-2017-2609MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autoEPSS 1.7%CVE-2021-21604—Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject craftedEPSS 1.7%CVE-2019-10354—A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fraEPSS 1.6%CVE-2022-34174—In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between logiEPSS 1.6%CVE-2019-1003004—An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AEPSS 1.6%CVE-2021-21697—Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins EPSS 1.6%CVE-2017-2613MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained untEPSS 1.6%CVE-2019-10384—Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSEPSS 1.6%CVE-2022-34170—In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the featuEPSS 1.6%CVE-2021-21685—Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirsEPSS 1.6%CVE-2022-34171—In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symboEPSS 1.6%CVE-2021-21693—When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 EPSS 1.6%CVE-2021-21694—FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in EPSS 1.6%CVE-2019-1003003—An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TEPSS 1.5%CVE-2017-2602LOWjenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master securitEPSS 1.5%CVE-2021-21689—FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and eEPSS 1.5%CVE-2019-10353—CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CEPSS 1.5%