Zaloguj się
Deutsch English Español Polski
Średnia

Lack of type validation in agent related REST API in Jenkins

  • Ujawniono: 24.05.2022
  • Aktualizacja: 11.10.2026 11:21

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the config.xml REST API endpoint of a node.

This allows attackers with Computer/Configure permission to replace a node with one of a different type.

Jenkins 2.287, LTS 2.277.2 validates the type of object created and rejects objects of unexpected types.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core < 2.277.2, >= 2.278, < 2.287 2.277.2, 2.287

Odnośniki

Ocena CVSS 4.3/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Słabość (CWE)
CWE-20
Platforma
Java / Kotlin (Maven)
Paczka
org.jenkins-ci.main:jenkins-core
Ujawniono
24.05.2022
Aktualizacja
11.10.2026 11:21

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-pvwx-3jx5-24r2 - CC BY 4.0

Historia podatności: org.jenkins-ci.main:jenkins-core

Wszystkie opisane podatności tej paczki (Java / Kotlin (Maven)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (259) w archiwum
Wszystkich wpisów
259
Pierwsza → ostatnia
01.2022 06.2026
Bez poprawki
1
Wykorzystywana w atakach
4

Rozkład istotności

  • Krytyczna 19
  • Wysoka 62
  • Średnia 158
  • Niska 20

Ujawnienia w latach

Istotność:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    Wysoka · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    Wysoka · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    Wysoka · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    Wysoka · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    Wysoka · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    Wysoka · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability
    Wysoka · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    Wysoka · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    Wysoka · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    Wysoka · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    Wysoka · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    Wysoka · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    Wysoka · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    Wysoka · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    Wysoka · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Unauthorized view fragment access in Jenkins
    Wysoka · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  20. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34172 >= 2.340, < 2.356, >= 2.332, < 2.332.4 2.356, 2.332.4
  22. Cross-site Scripting vulnerability in Jenkins
    Wysoka · 8.0 CVE-2022-34171 >= 2.350, < 2.356, >= 2.346, < 2.346.1, < 2.332.4 2.356, 2.346.1, 2.332.4
  23. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21686 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  24. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21685 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  25. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21689 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  26. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21690 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  27. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21692 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  28. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21693 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  29. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21694 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  30. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21688 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  31. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21691 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  32. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21687 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  33. Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
    Wysoka · 8.8 CVE-2021-21696 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  34. Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
    Krytyczna · 9.1 CVE-2021-21697 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  35. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Krytyczna · 9.0 CVE-2021-21695 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  36. Session fixation vulnerability in Jenkins
    Wysoka · 7.5 CVE-2021-21671 >= 2.292, < 2.300, < 2.289.2 2.300, 2.289.2
  37. Lack of type validation in agent related REST API in Jenkins ten wpis
    Średnia · 4.3 CVE-2021-21639 < 2.277.2, >= 2.278, < 2.287 2.277.2, 2.287
  38. Path traversal vulnerability in Jenkins agent names
    Wysoka · 8.0 CVE-2021-21605 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  39. Improper handling of REST API XML deserialization errors in Jenkins
    Wysoka · 8.0 CVE-2021-21604 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  40. Jenkins Cross-site Scripting vulnerability in project naming strategy
    Wysoka · 8.0 CVE-2020-2230 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  41. Jenkins Cross-Site Scripting vulnerability in help icons
    Wysoka · 8.0 CVE-2020-2229 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  42. Stored XSS vulnerability in Jenkins 'keep forever' badge icon
    Wysoka · 8.0 CVE-2020-2222 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  43. Stored XSS vulnerability in Jenkins upstream cause
    Wysoka · 8.0 CVE-2020-2221 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  44. Stored XSS vulnerability in Jenkins job build time trend
    Wysoka · 8.0 CVE-2020-2220 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  45. Stored XSS vulnerability in Jenkins console links
    Wysoka · 8.0 CVE-2020-2223 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  46. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.8 CVE-2020-2160 < 2.204.6, >= 2.205, < 2.228 2.204.6, 2.228
  47. Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
    Wysoka · 8.6 CVE-2020-2099 < 2.204.2, >= 2.205, < 2.214 2.204.2, 2.214
  48. XML external entity (XXE) vulnerability in Jenkins
    Wysoka · 7.5 CVE-2015-1811 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  49. XML external entity (XXE) vulnerability in Jenkins
    Wysoka · 7.5 CVE-2015-1809 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  50. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.8 CVE-2019-10384 < 2.176.3, >= 2.177, < 2.192 2.176.3, 2.192
  51. Cross-Site Request Forgery in Jenkins
    Wysoka · 7.5 CVE-2019-10353 < 2.176.2, >= 2.177, < 2.186 2.176.2, 2.186
  52. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Krytyczna · 9.8 CVE-2017-1000362 >= 1.498, < 2.32.2, >= 2.40, < 2.44 2.32.2, 2.44
  53. Jenkins allows Execution of Code by Opening a JRMP Listener
    Krytyczna · 9.8 CVE-2016-0788 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  54. Jenkins allows Deserialization of Untrusted Data via an XML File
    Wysoka · 8.8 CVE-2016-0792 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  55. Exposure of Sensitive Information in Jenkins Core
    Krytyczna · 9.8 CVE-2016-0791 < 1.650 1.650
  56. Jenkins affected by Open Redirect Vulnerability
    Wysoka · 7.4 CVE-2016-3726 >= 1.652, < 2.3, < 1.651.2 2.3, 1.651.2
  57. Race Condition in Jenkins
    Wysoka · 8.1 CVE-2017-1000503 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  58. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.8 CVE-2017-1000356 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  59. Improper Authentication in Jenkins
    Wysoka · 8.8 CVE-2017-1000354 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  60. Cross-Site Request Forgery in Jenkins
    Wysoka · 8.1 CVE-2017-1000504 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  61. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Wysoka · 7.8 CVE-2018-1000410 < 2.138.2, >= 2.140, < 2.146 2.138.2, 2.146
  62. Improper Input Validation in Jenkins
    Wysoka · 7.5 CVE-2017-1000394 < 2.73.2, >= 2.74, < 2.84 2.73.2, 2.84
  63. Improper Input Validation in Jenkins
    Wysoka · 7.3 CVE-2017-1000391 < 2.73.3, >= 2.74, < 2.89 2.73.3, 2.89
  64. OS Command Injection in Jenkins
    Wysoka · 8.8 CVE-2017-1000393 < 2.73.2, >= 2.74, < 2.84 2.73.2, 2.84
  65. Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
    Krytyczna · 9.8 CVE-2016-9299 >= 2.20, < 2.32, < 2.19.3 2.32, 2.19.3
  66. Missing Release of Resource after Effective Lifetime in Jenkins
    Wysoka · 7.5 CVE-2018-1999043 < 2.121.3, >= 2.122, < 2.138 2.121.3, 2.138
  67. Improper Limitation of a Pathname to a Restricted Directory in Jenkins
    Wysoka · 8.2 CVE-2018-1000863 < 2.138.4, >= 2.140, < 2.154 2.138.4, 2.154
  68. Deserialization of Untrusted Data in Jenkins
    Wysoka · 8.8 CVE-2017-2608 < 2.32.2, >= 2.34, < 2.44 2.32.2, 2.44
  69. Jenkins does not Verify Checksums for Plugin Files
    Wysoka · 7.5 CVE-2015-7539 < 1.625.2, >= 1.626, < 1.640 1.625.2, 1.640
  70. Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
    Wysoka · 8.8 CVE-2015-7537 >= 1.626, < 1.640, < 1.625.2 1.640, 1.625.2
  71. Jenkins discloses project names via fingerprints
    Wysoka · 7.5 Wykorzystywana w atakach CVE-2015-5317 < 1.625.2, >= 1.626, < 1.638 1.625.2, 1.638
  72. Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
    Wysoka · 8.8 CVE-2015-7538 >= 1.626, < 1.640, < 1.625.2 1.640, 1.625.2
  73. Improper Authorization in Jenkins Core
    Wysoka · 7.2 CVE-2019-1003003 < 2.150.2, >= 2.151, < 2.159 2.150.2, 2.159
  74. Improper Authorization in Jenkins Core
    Wysoka · 7.2 CVE-2019-1003004 < 2.159 2.159
  75. Deserialization of Untrusted Data in Jenkins
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2017-1000353 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  76. Improper Input Validation in Jenkins
    Wysoka · 7.5 CVE-2018-1999002 < 2.121.2, >= 2.122, < 2.132 2.121.2, 2.132
  77. Insufficient Session Expiration in Jenkins
    Wysoka · 8.1 CVE-2019-1003049 < 2.164.2, >= 2.165, < 2.172 2.164.2, 2.172
  78. Path Traversal in Jenkins
    Wysoka · 8.1 CVE-2018-1000194 < 2.107.3, >= 2.108, < 2.121 2.107.3, 2.121
  79. Deserialization of Untrusted Data in Jenkins
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2018-1000861 < 2.138.4, >= 2.140, < 2.154 2.138.4, 2.154
  80. Improper Input Validation in Jenkins
    Wysoka · 8.8 CVE-2018-1999001 < 2.121.2, >= 2.122, < 2.132 2.121.2, 2.132
Pokaż więcej (2) Widać 80 z 82

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.