Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
<= 2.89.3
>= 2.90, <= 2.106
Patched versions
2.89.4
2.107
Description
Published by the National Vulnerability Database
Feb 16, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jun 30, 2022
Last updated
Jan 27, 2023
An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.
References