Exposição de Jenkins

CI
44
score de exposição
14
sites usam
1
em exploração
3
críticos
Análise Vexday

Jenkins acumula 141 CVEs catalogadas, com 8 novas surgidas nos últimos 90 dias, indicando um fluxo contínuo de descobertas que exige acompanhamento ativo. A taxa de exploração ativa está acima da média geral do catálogo — 1,6× superior —, e a CVE mais perigosa em atividade, CVE-2024-23897, registra EPSS máximo de 1,0, sinalizando probabilidade praticamente certa de exploração em ambientes expostos. O tipo de falha mais recorrente é CWE-862 (ausência de verificação de autorização), uma classe de vulnerabilidade que tende a viabilizar acesso não autorizado a funcionalidades críticas em ambientes de CI/CD. Equipes que operam Jenkins devem priorizar a correção das CVEs críticas e verificar imediatamente a exposição à CVE-2024-23897, dado o risco concreto e imediato que ela representa.

CVEs

174 resultados
CVE-2025-27625MEDIUMIn Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attaEPSS 0.6%CVE-2026-117616HIGHJenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowingEPSS 0.6%CVE-2026-84648HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestaEPSS 0.6%CVE-2025-67635HIGHJenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corEPSS 0.6%CVE-2026-84647HIGHIn Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,EPSS 0.5%CVE-2026-84646MEDIUMIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allEPSS 0.5%CVE-2026-70426CRITICALIn Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, EPSS 0.5%CVE-2025-59475MEDIUMJenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allEPSS 0.5%CVE-2026-27099HIGHJenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of EPSS 0.5%CVE-2026-84655MEDIUMJenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST APIEPSS 0.5%CVE-2026-117617HIGHJenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parenEPSS 0.5%CVE-2026-70430LOWJenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naEPSS 0.5%CVE-2026-84651MEDIUMIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submEPSS 0.5%CVE-2026-84650HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to EPSS 0.5%CVE-2026-84656MEDIUMA missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one EPSS 0.5%CVE-2026-84652HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember meEPSS 0.4%CVE-2025-27624MEDIUMA cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users togglEPSS 0.4%CVE-2026-53437MEDIUMJenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsEPSS 0.4%CVE-2026-117615MEDIUMJenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attaEPSS 0.4%CVE-2026-70429HIGHJenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackeEPSS 0.4%