GitHub Advisoryadvisory · Maven

GHSA-wj5c-j656-h5fw Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

MEDIUM Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-2600
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-07-01

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.32.2 → fixed in 2.32.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.34, < 2.44 → fixed in 2.44

Description

In Jenkins before versions 2.44 and 2.32.2, node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).

Related

Alias · CVE (1)

  • CVE-2017-2600 In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References