4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
0.005 Low
EPSS
Percentile
76.5%
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not serve the X-Frame-Options: deny
HTTP header on REST API responses to protect against clickjacking attacks. An attacker could exploit this by routing the victim through a specially crafted web page that embeds a REST API endpoint in an iframe and tricking the user into performing an action which would allow for the attacker to learn the content of that REST API endpoint.
Jenkins 2.219, LTS 2.204.2 now adds the X-Frame-Options: deny
HTTP header to REST API responses, which prevents these types of clickjacking attacks.
CPE | Name | Operator | Version |
---|---|---|---|
org.jenkins-ci.main:jenkins-core | le | 2.218 | |
org.jenkins-ci.main:jenkins-core | le | 2.204.1 |
www.openwall.com/lists/oss-security/2020/01/29/1
access.redhat.com/errata/RHBA-2020:0402
access.redhat.com/errata/RHBA-2020:0675
access.redhat.com/errata/RHSA-2020:0681
access.redhat.com/errata/RHSA-2020:0683
github.com/advisories/GHSA-7xp8-7wqx-5hqx
github.com/jenkinsci/jenkins/commit/639ade55caa05324c60d15b2fa8df27ee0111b76
jenkins.io/security/advisory/2020-01-29/#SECURITY-1704
nvd.nist.gov/vuln/detail/CVE-2020-2105
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
0.005 Low
EPSS
Percentile
76.5%