Business information leak In org.jenkins-ci.main:jenkins-core
Description
Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.583, 1.565.3 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3.