Improper authorization control for web services In org.jenkins-ci.main:jenkins-core
Description
Jenkins exposes other users' timezone and view names to users with Overall/Read permission Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views".
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.555.3, 2.568 |
Aliases
1. 2. 3. 4.
References
1. 2. 3.