GitHub Advisoryadvisory · Maven

GHSA-rrgp-c2w8-6vg6 Information disclosure through error stack traces related to agents

LOW Published 2023-03-10 Modified 2023-05-23 Official page ↗
Aliases
CVE-2023-27904
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Reviewed
2023-03-16

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.376, < 2.387.1 → fixed in 2.387.1 • Maven org.jenkins-ci.main:jenkins-core: < 2.375.4 → fixed in 2.375.4 • Maven org.jenkins-ci.main:jenkins-core: >= 2.388, < 2.394 → fixed in 2.394

Description

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers. Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 does not display error stack traces when agent connections are broken.

Related

Alias · CVE (1)

  • CVE-2023-27904 Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken,… vulnerability

References