Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Date: 2022-05
Affected: maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2017-1000393
CVE-2017-1000398
CVE-2018-1000169
CVE-2018-1000862
CVE-2018-1999046
CWE: CWE-200
CWE-78
CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.


Mitigations:

Architectural layers (MAESTRO):