MEDIUM
jenkins: CLI and UI allow non-admin users to enumerate installed plugins (SECURITY-771)
Published Jun 5, 2018
4.3
MEDIUMCVSS 3.1
EPSS 1.11%
Description
A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
Affected products
No data.
No data.
Red Hat OpenShift Enterprise 3
jenkins
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Enterprise 3 | jenkins | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (10)
- https://access.redhat.com/security/cve/CVE-2018-1000192 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1576706 Issue Tracking
- https://github.com/advisories/GHSA-2w4x-rxp7-grg7 Advisory
- https://github.com/jenkinsci/jenkins/commit/7c5b41bfd5d8004f82684a9168dd627e20ea5f35
- https://github.com/jenkinsci/jenkins/commit/809916b59b7c7678dc3c1c76338452121fed1424
- https://jenkins.io/security/advisory/2018-05-09/
- https://jenkins.io/security/advisory/2018-05-09/#SECURITY-771 x_refsource_CONFIRMVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000192
- https://www.cve.org/CVERecord?id=CVE-2018-1000192
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 5, 2018
Updated Aug 5, 2024
Reserved May 9, 2018
Link CVE-2018-1000192
CISA Vulnrichment
GHSA-2W4X-RXP7-GRG7 Updated n/a