Anmelden
Deutsch English Español Polski
Mittel

Jenkins Diagnostic page exposed session cookies

  • Veröffentlicht: 24.05.2022
  • Aktualisiert: 11.10.2026 11:21

Jenkins shows various technical details about the current user on the /whoAmI page. In a previous fix, the Cookie header value containing the HTTP session ID was redacted. However, user metadata shown on this page could also include the HTTP session ID in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier.

This allows attackers able to exploit a cross-site scripting vulnerability to obtain the HTTP session ID value from this page.

Jenkins 2.219, LTS 2.204.2 no longer prints out the affected user metadata that might contain the HTTP session ID.

Additionally, we also redact values of further authentication-related HTTP headers in addition to Cookie on this page as a hardening.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core >= 2.205, < 2.219, < 2.204.2 2.219, 2.204.2

Verweise

CVSS-Wert 5.4/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Schwäche (CWE)
CWE-200
Plattform
Java / Kotlin (Maven)
Paket
org.jenkins-ci.main:jenkins-core
Veröffentlicht
24.05.2022
Aktualisiert
11.10.2026 11:21

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-4jjj-cm7q-v6hr - CC BY 4.0

Schwachstellenhistorie: org.jenkins-ci.main:jenkins-core

Alle veröffentlichten Schwachstellen dieses Pakets (Java / Kotlin (Maven)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (259) im Archiv
Einträge insgesamt
259
Erste → letzte
01.2022 06.2026
Ohne Fix
1
In Angriffen ausgenutzt
4

Verteilung nach Schweregrad

  • Kritisch 19
  • Hoch 62
  • Mittel 158
  • Niedrig 20

Veröffentlichungen pro Jahr

Schweregrad:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    Hoch · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    Hoch · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    Hoch · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    Hoch · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    Hoch · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    Hoch · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability
    Hoch · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Kritisch · 9.8 In Angriffen ausgenutzt CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    Hoch · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    Hoch · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    Hoch · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    Hoch · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    Hoch · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    Hoch · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    Hoch · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    Hoch · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Unauthorized view fragment access in Jenkins
    Hoch · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  20. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34172 >= 2.340, < 2.356, >= 2.332, < 2.332.4 2.356, 2.332.4
  22. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34171 >= 2.350, < 2.356, >= 2.346, < 2.346.1, < 2.332.4 2.356, 2.346.1, 2.332.4
  23. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21686 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  24. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21685 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  25. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21689 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  26. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21690 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  27. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21692 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  28. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21693 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  29. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21694 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  30. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21688 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  31. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21691 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  32. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21687 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  33. Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
    Hoch · 8.8 CVE-2021-21696 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  34. Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
    Kritisch · 9.1 CVE-2021-21697 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  35. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21695 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  36. Session fixation vulnerability in Jenkins
    Hoch · 7.5 CVE-2021-21671 >= 2.292, < 2.300, < 2.289.2 2.300, 2.289.2
  37. Path traversal vulnerability in Jenkins agent names
    Hoch · 8.0 CVE-2021-21605 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  38. Improper handling of REST API XML deserialization errors in Jenkins
    Hoch · 8.0 CVE-2021-21604 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  39. Jenkins Cross-site Scripting vulnerability in project naming strategy
    Hoch · 8.0 CVE-2020-2230 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  40. Jenkins Cross-Site Scripting vulnerability in help icons
    Hoch · 8.0 CVE-2020-2229 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  41. Stored XSS vulnerability in Jenkins 'keep forever' badge icon
    Hoch · 8.0 CVE-2020-2222 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  42. Stored XSS vulnerability in Jenkins upstream cause
    Hoch · 8.0 CVE-2020-2221 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  43. Stored XSS vulnerability in Jenkins job build time trend
    Hoch · 8.0 CVE-2020-2220 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  44. Stored XSS vulnerability in Jenkins console links
    Hoch · 8.0 CVE-2020-2223 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  45. Cross-Site Request Forgery in Jenkins
    Hoch · 8.8 CVE-2020-2160 < 2.204.6, >= 2.205, < 2.228 2.204.6, 2.228
  46. Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
    Hoch · 8.6 CVE-2020-2099 < 2.204.2, >= 2.205, < 2.214 2.204.2, 2.214
  47. Jenkins Diagnostic page exposed session cookies dieser Eintrag
    Mittel · 5.4 CVE-2020-2103 >= 2.205, < 2.219, < 2.204.2 2.219, 2.204.2
  48. XML external entity (XXE) vulnerability in Jenkins
    Hoch · 7.5 CVE-2015-1811 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  49. XML external entity (XXE) vulnerability in Jenkins
    Hoch · 7.5 CVE-2015-1809 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  50. Cross-Site Request Forgery in Jenkins
    Hoch · 8.8 CVE-2019-10384 < 2.176.3, >= 2.177, < 2.192 2.176.3, 2.192
  51. Cross-Site Request Forgery in Jenkins
    Hoch · 7.5 CVE-2019-10353 < 2.176.2, >= 2.177, < 2.186 2.176.2, 2.186
  52. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Kritisch · 9.8 CVE-2017-1000362 >= 1.498, < 2.32.2, >= 2.40, < 2.44 2.32.2, 2.44
  53. Jenkins allows Execution of Code by Opening a JRMP Listener
    Kritisch · 9.8 CVE-2016-0788 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  54. Jenkins allows Deserialization of Untrusted Data via an XML File
    Hoch · 8.8 CVE-2016-0792 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  55. Exposure of Sensitive Information in Jenkins Core
    Kritisch · 9.8 CVE-2016-0791 < 1.650 1.650
  56. Jenkins affected by Open Redirect Vulnerability
    Hoch · 7.4 CVE-2016-3726 >= 1.652, < 2.3, < 1.651.2 2.3, 1.651.2
  57. Race Condition in Jenkins
    Hoch · 8.1 CVE-2017-1000503 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  58. Cross-Site Request Forgery in Jenkins
    Hoch · 8.8 CVE-2017-1000356 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  59. Improper Authentication in Jenkins
    Hoch · 8.8 CVE-2017-1000354 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  60. Cross-Site Request Forgery in Jenkins
    Hoch · 8.1 CVE-2017-1000504 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  61. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Hoch · 7.8 CVE-2018-1000410 < 2.138.2, >= 2.140, < 2.146 2.138.2, 2.146
  62. Improper Input Validation in Jenkins
    Hoch · 7.5 CVE-2017-1000394 < 2.73.2, >= 2.74, < 2.84 2.73.2, 2.84
  63. Improper Input Validation in Jenkins
    Hoch · 7.3 CVE-2017-1000391 < 2.73.3, >= 2.74, < 2.89 2.73.3, 2.89
  64. OS Command Injection in Jenkins
    Hoch · 8.8 CVE-2017-1000393 < 2.73.2, >= 2.74, < 2.84 2.73.2, 2.84
  65. Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
    Kritisch · 9.8 CVE-2016-9299 >= 2.20, < 2.32, < 2.19.3 2.32, 2.19.3
  66. Missing Release of Resource after Effective Lifetime in Jenkins
    Hoch · 7.5 CVE-2018-1999043 < 2.121.3, >= 2.122, < 2.138 2.121.3, 2.138
  67. Improper Limitation of a Pathname to a Restricted Directory in Jenkins
    Hoch · 8.2 CVE-2018-1000863 < 2.138.4, >= 2.140, < 2.154 2.138.4, 2.154
  68. Deserialization of Untrusted Data in Jenkins
    Hoch · 8.8 CVE-2017-2608 < 2.32.2, >= 2.34, < 2.44 2.32.2, 2.44
  69. Jenkins does not Verify Checksums for Plugin Files
    Hoch · 7.5 CVE-2015-7539 < 1.625.2, >= 1.626, < 1.640 1.625.2, 1.640
  70. Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
    Hoch · 8.8 CVE-2015-7537 >= 1.626, < 1.640, < 1.625.2 1.640, 1.625.2
  71. Jenkins discloses project names via fingerprints
    Hoch · 7.5 In Angriffen ausgenutzt CVE-2015-5317 < 1.625.2, >= 1.626, < 1.638 1.625.2, 1.638
  72. Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
    Hoch · 8.8 CVE-2015-7538 >= 1.626, < 1.640, < 1.625.2 1.640, 1.625.2
  73. Improper Authorization in Jenkins Core
    Hoch · 7.2 CVE-2019-1003003 < 2.150.2, >= 2.151, < 2.159 2.150.2, 2.159
  74. Improper Authorization in Jenkins Core
    Hoch · 7.2 CVE-2019-1003004 < 2.159 2.159
  75. Deserialization of Untrusted Data in Jenkins
    Kritisch · 9.8 In Angriffen ausgenutzt CVE-2017-1000353 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  76. Improper Input Validation in Jenkins
    Hoch · 7.5 CVE-2018-1999002 < 2.121.2, >= 2.122, < 2.132 2.121.2, 2.132
  77. Insufficient Session Expiration in Jenkins
    Hoch · 8.1 CVE-2019-1003049 < 2.164.2, >= 2.165, < 2.172 2.164.2, 2.172
  78. Path Traversal in Jenkins
    Hoch · 8.1 CVE-2018-1000194 < 2.107.3, >= 2.108, < 2.121 2.107.3, 2.121
  79. Deserialization of Untrusted Data in Jenkins
    Kritisch · 9.8 In Angriffen ausgenutzt CVE-2018-1000861 < 2.138.4, >= 2.140, < 2.154 2.138.4, 2.154
  80. Improper Input Validation in Jenkins
    Hoch · 8.8 CVE-2018-1999001 < 2.121.2, >= 2.122, < 2.132 2.121.2, 2.132
Mehr anzeigen (2) 80 von 82 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.