GitHub Advisoryadvisory · Maven

GHSA-x6jw-2f23-mc5j Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

MEDIUM Published 2022-05-13 Modified 2022-06-30 Official page ↗
Aliases
CVE-2018-1000068
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-06-30

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.89.4 → fixed in 2.89.4 • Maven org.jenkins-ci.main:jenkins-core: >= 2.90, < 2.107 → fixed in 2.107

Description

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.

Related

Alias · CVE (1)

  • CVE-2018-1000068 An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References