GitHub Advisoryadvisory · Maven

GHSA-f7f6-xrwc-9c57 Improper Input Validation in Jenkins

HIGH Published 2022-05-14 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-1000394
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2022-07-01

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.73.2 → fixed in 2.73.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.74, < 2.84 → fixed in 2.84

Description

Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jenkins.

Related

Alias · CVE (1)

  • CVE-2017-1000394 Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References