Jenkins

Jenkins

251 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2022-34175

  • EPSS 3.74%
  • Published 23.06.2022 17:15:15
  • Last modified 21.11.2024 07:09:00

Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.

7.5

CVE-2022-0538

  • EPSS 3.15%
  • Published 09.02.2022 14:15:07
  • Last modified 21.11.2024 06:38:52

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

7.5

CVE-2021-43859

Exploit
  • EPSS 2.4%
  • Published 01.02.2022 12:15:08
  • Last modified 23.05.2025 16:53:31

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resul...

4.3

CVE-2022-20612

  • EPSS 0.16%
  • Published 12.01.2022 20:15:08
  • Last modified 21.11.2024 06:43:09

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

8.1

CVE-2021-21686

  • EPSS 0.2%
  • Published 04.11.2021 17:15:08
  • Last modified 21.11.2024 05:48:50

File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

9.1

CVE-2021-21687

  • EPSS 0.4%
  • Published 04.11.2021 17:15:08
  • Last modified 21.11.2024 05:48:50

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.

7.5

CVE-2021-21688

  • EPSS 0.44%
  • Published 04.11.2021 17:15:08
  • Last modified 21.11.2024 05:48:50

The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, Fi...

9.1

CVE-2021-21689

  • EPSS 1.76%
  • Published 04.11.2021 17:15:08
  • Last modified 21.11.2024 05:48:50

FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

9.8

CVE-2021-21690

  • EPSS 0.37%
  • Published 04.11.2021 17:15:08
  • Last modified 21.11.2024 05:48:50

Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

9.8

CVE-2021-21691

  • EPSS 0.47%
  • Published 04.11.2021 17:15:08
  • Last modified 21.11.2024 05:48:50

Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.