Anmelden
Deutsch English Español Polski
Mittel

Improper Neutralization of Input During Web Page Generation in Jenkins

  • Veröffentlicht: 24.05.2022
  • Aktualisiert: 11.10.2026 11:22

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier served files uploaded as file parameters to a build without specifying appropriate Content-Security-Policy HTTP headers. This resulted in a stored cross-site scripting (XSS) vulnerability exploitable by users with permissions to build a job with file parameters.\n\nJenkins now sets Content-Security-Policy HTTP headers when serving files uploaded via a file parameter to the same value as used for files in workspaces and archived artifacts not served using the Resource Root URL.\n\nThe system property hudson.model.DirectoryBrowserSupport.CSP can be set to override the value of Content-Security-Policy headers sent when serving these files. This is the same system property used for files in workspaces and archived artifacts unless those are served via the Resource Root URL and works the same way for file parameters. See Configuring Content Security Policy to learn more.\n\nEven when Jenkins is configured to serve files in workspaces and archived artifacts using the Resource Root URL (introduced in Jenkins 2.200), file parameters are not, and therefore still subject to Content-Security-Policy restrictions.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core < 2.228, >= 2.204.6, < 2.228 2.228

Verweise

CVSS-Wert 5.4/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Schwäche (CWE)
CWE-79
Plattform
Java / Kotlin (Maven)
Paket
org.jenkins-ci.main:jenkins-core
Veröffentlicht
24.05.2022
Aktualisiert
11.10.2026 11:22

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-crg2-6xv3-qg5f - CC BY 4.0

Schwachstellenhistorie: org.jenkins-ci.main:jenkins-core

Alle veröffentlichten Schwachstellen dieses Pakets (Java / Kotlin (Maven)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (259) im Archiv
Einträge insgesamt
259
Erste → letzte
01.2022 06.2026
Ohne Fix
1
In Angriffen ausgenutzt
4

Verteilung nach Schweregrad

  • Kritisch 19
  • Hoch 62
  • Mittel 158
  • Niedrig 20

Veröffentlichungen pro Jahr

Schweregrad:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    Hoch · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    Hoch · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    Hoch · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    Hoch · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    Hoch · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    Hoch · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability
    Hoch · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Kritisch · 9.8 In Angriffen ausgenutzt CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    Hoch · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    Hoch · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    Hoch · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    Hoch · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    Hoch · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    Hoch · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    Hoch · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    Hoch · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Unauthorized view fragment access in Jenkins
    Hoch · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  20. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34172 >= 2.340, < 2.356, >= 2.332, < 2.332.4 2.356, 2.332.4
  22. Cross-site Scripting vulnerability in Jenkins
    Hoch · 8.0 CVE-2022-34171 >= 2.350, < 2.356, >= 2.346, < 2.346.1, < 2.332.4 2.356, 2.346.1, 2.332.4
  23. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21686 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  24. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21685 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  25. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21689 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  26. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21690 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  27. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21692 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  28. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21693 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  29. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21694 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  30. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21688 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  31. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21691 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  32. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21687 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  33. Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
    Hoch · 8.8 CVE-2021-21696 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  34. Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
    Kritisch · 9.1 CVE-2021-21697 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  35. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Kritisch · 9.0 CVE-2021-21695 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  36. Session fixation vulnerability in Jenkins
    Hoch · 7.5 CVE-2021-21671 >= 2.292, < 2.300, < 2.289.2 2.300, 2.289.2
  37. Path traversal vulnerability in Jenkins agent names
    Hoch · 8.0 CVE-2021-21605 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  38. Improper handling of REST API XML deserialization errors in Jenkins
    Hoch · 8.0 CVE-2021-21604 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  39. Jenkins Cross-site Scripting vulnerability in project naming strategy
    Hoch · 8.0 CVE-2020-2230 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  40. Jenkins Cross-Site Scripting vulnerability in help icons
    Hoch · 8.0 CVE-2020-2229 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  41. Stored XSS vulnerability in Jenkins 'keep forever' badge icon
    Hoch · 8.0 CVE-2020-2222 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  42. Stored XSS vulnerability in Jenkins upstream cause
    Hoch · 8.0 CVE-2020-2221 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  43. Stored XSS vulnerability in Jenkins job build time trend
    Hoch · 8.0 CVE-2020-2220 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  44. Stored XSS vulnerability in Jenkins console links
    Hoch · 8.0 CVE-2020-2223 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  45. Cross-Site Request Forgery in Jenkins
    Hoch · 8.8 CVE-2020-2160 < 2.204.6, >= 2.205, < 2.228 2.204.6, 2.228
  46. Improper Neutralization of Input During Web Page Generation in Jenkins dieser Eintrag
    Mittel · 5.4 CVE-2020-2162 < 2.228, >= 2.204.6, < 2.228 2.228
  47. Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
    Hoch · 8.6 CVE-2020-2099 < 2.204.2, >= 2.205, < 2.214 2.204.2, 2.214
  48. XML external entity (XXE) vulnerability in Jenkins
    Hoch · 7.5 CVE-2015-1811 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  49. XML external entity (XXE) vulnerability in Jenkins
    Hoch · 7.5 CVE-2015-1809 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  50. Cross-Site Request Forgery in Jenkins
    Hoch · 8.8 CVE-2019-10384 < 2.176.3, >= 2.177, < 2.192 2.176.3, 2.192
  51. Cross-Site Request Forgery in Jenkins
    Hoch · 7.5 CVE-2019-10353 < 2.176.2, >= 2.177, < 2.186 2.176.2, 2.186
  52. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Kritisch · 9.8 CVE-2017-1000362 >= 1.498, < 2.32.2, >= 2.40, < 2.44 2.32.2, 2.44
  53. Jenkins allows Execution of Code by Opening a JRMP Listener
    Kritisch · 9.8 CVE-2016-0788 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  54. Jenkins allows Deserialization of Untrusted Data via an XML File
    Hoch · 8.8 CVE-2016-0792 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  55. Exposure of Sensitive Information in Jenkins Core
    Kritisch · 9.8 CVE-2016-0791 < 1.650 1.650
  56. Jenkins affected by Open Redirect Vulnerability
    Hoch · 7.4 CVE-2016-3726 >= 1.652, < 2.3, < 1.651.2 2.3, 1.651.2
  57. Race Condition in Jenkins
    Hoch · 8.1 CVE-2017-1000503 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  58. Cross-Site Request Forgery in Jenkins
    Hoch · 8.8 CVE-2017-1000356 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  59. Improper Authentication in Jenkins
    Hoch · 8.8 CVE-2017-1000354 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  60. Cross-Site Request Forgery in Jenkins
    Hoch · 8.1 CVE-2017-1000504 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
Mehr anzeigen (20) 60 von 82 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.