Zaloguj się
Deutsch English Español Polski
Średnia

Missing permission check for paths with specific prefix in Jenkins

  • Ujawniono: 24.05.2022
  • Aktualizacja: 11.10.2026 11:22

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list.

This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required:

  • accessDenied
  • error
  • instance-identity
  • login
  • logout
  • oops
  • securityRealm
  • signup
  • tcpSlaveAgentListener

For example, a plugin contributing the path loginFoo/ would have URLs in that space accessible without the default Overall/Read permission check.

The Jenkins security team is not aware of any affected plugins as of the publication of this advisory.

The comparison of requested URLs with the list of always accessible URLs has been fixed to only allow access to the specific listed URLs in Jenkins 2.275, LTS 2.263.2.

In case this change causes problems, additional paths can be made accessible without Overall/Read permissions: The Java system property jenkins.model.Jenkins.additionalReadablePaths is a comma-separated list of additional path prefixes to allow access to.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275

Odnośniki

Ocena CVSS 5.3/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Słabość (CWE)
CWE-863
Platforma
Java / Kotlin (Maven)
Paczka
org.jenkins-ci.main:jenkins-core
Ujawniono
24.05.2022
Aktualizacja
11.10.2026 11:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-4625-q52w-39cx - CC BY 4.0

Historia podatności: org.jenkins-ci.main:jenkins-core

Wszystkie opisane podatności tej paczki (Java / Kotlin (Maven)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (259) w archiwum
Wszystkich wpisów
259
Pierwsza → ostatnia
01.2022 06.2026
Bez poprawki
1
Wykorzystywana w atakach
4

Rozkład istotności

  • Krytyczna 19
  • Wysoka 62
  • Średnia 158
  • Niska 20

Ujawnienia w latach

Istotność:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    Wysoka · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    Wysoka · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    Wysoka · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    Wysoka · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    Wysoka · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    Wysoka · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability
    Wysoka · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    Wysoka · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    Wysoka · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    Wysoka · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    Wysoka · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    Wysoka · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    Wysoka · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    Wysoka · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    Wysoka · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Unauthorized view fragment access in Jenkins
    Wysoka · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  20. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34172 >= 2.340, < 2.356, >= 2.332, < 2.332.4 2.356, 2.332.4
  22. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34171 >= 2.350, < 2.356, >= 2.346, < 2.346.1, < 2.332.4 2.356, 2.346.1, 2.332.4
  23. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21686 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  24. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21685 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  25. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21689 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  26. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21690 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  27. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21692 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  28. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21693 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  29. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21694 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  30. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21688 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  31. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21691 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  32. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21687 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  33. Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
    Wysoka · 8.8 CVE-2021-21696 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  34. Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
    Krytyczna · 9.1 CVE-2021-21697 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  35. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21695 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  36. Session fixation vulnerability in Jenkins
    Wysoka · 7.5 CVE-2021-21671 >= 2.292, < 2.300, < 2.289.2 2.300, 2.289.2
  37. Path traversal vulnerability in Jenkins agent names
    Wysoka · 8.0 CVE-2021-21605 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  38. Missing permission check for paths with specific prefix in Jenkins ten wpis
    Średnia · 5.3 CVE-2021-21609 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  39. Improper handling of REST API XML deserialization errors in Jenkins
    Wysoka · 8.0 CVE-2021-21604 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  40. Jenkins Cross-site Scripting vulnerability in project naming strategy
    Wysoka · 8.0 CVE-2020-2230 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  41. Jenkins Cross-Site Scripting vulnerability in help icons
    Wysoka · 8.0 CVE-2020-2229 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  42. Stored XSS vulnerability in Jenkins 'keep forever' badge icon
    Wysoka · 8.0 CVE-2020-2222 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  43. Stored XSS vulnerability in Jenkins upstream cause
    Wysoka · 8.0 CVE-2020-2221 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  44. Stored XSS vulnerability in Jenkins job build time trend
    Wysoka · 8.0 CVE-2020-2220 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  45. Stored XSS vulnerability in Jenkins console links
    Wysoka · 8.0 CVE-2020-2223 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  46. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.8 CVE-2020-2160 < 2.204.6, >= 2.205, < 2.228 2.204.6, 2.228
  47. Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
    Wysoka · 8.6 CVE-2020-2099 < 2.204.2, >= 2.205, < 2.214 2.204.2, 2.214
  48. XML external entity (XXE) vulnerability in Jenkins
    Wysoka · 7.5 CVE-2015-1811 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  49. XML external entity (XXE) vulnerability in Jenkins
    Wysoka · 7.5 CVE-2015-1809 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  50. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.8 CVE-2019-10384 < 2.176.3, >= 2.177, < 2.192 2.176.3, 2.192
  51. Cross-Site Request Forgery in Jenkins
    Wysoka · 7.5 CVE-2019-10353 < 2.176.2, >= 2.177, < 2.186 2.176.2, 2.186
  52. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Krytyczna · 9.8 CVE-2017-1000362 >= 1.498, < 2.32.2, >= 2.40, < 2.44 2.32.2, 2.44
  53. Jenkins allows Execution of Code by Opening a JRMP Listener
    Krytyczna · 9.8 CVE-2016-0788 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  54. Jenkins allows Deserialization of Untrusted Data via an XML File
    Wysoka · 8.8 CVE-2016-0792 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  55. Exposure of Sensitive Information in Jenkins Core
    Krytyczna · 9.8 CVE-2016-0791 < 1.650 1.650
  56. Jenkins affected by Open Redirect Vulnerability
    Wysoka · 7.4 CVE-2016-3726 >= 1.652, < 2.3, < 1.651.2 2.3, 1.651.2
  57. Race Condition in Jenkins
    Wysoka · 8.1 CVE-2017-1000503 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  58. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.8 CVE-2017-1000356 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  59. Improper Authentication in Jenkins
    Wysoka · 8.8 CVE-2017-1000354 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  60. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.1 CVE-2017-1000504 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
Pokaż więcej (20) Widać 60 z 82

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.