CVE-2024-43044

CVE-2024-43044 描述 此脚本通过获取 Jenkins 实例的版本号并与已知的受影响版本范围进行比对，来检查 Jenkins 实例是否存在 CVE-2024-43044 漏洞。 CVE-2024-43044 ：此漏洞影响 Jenkins 核心和 remoting 版本，允许攻击者利用某些版本的 Jenkins。关于此 CVE 的详细信息请参见此处。 GHSA-h856-ffvv-xvr4 ：此安全公告涵盖了 Jenkins 版本中的另一组漏洞，提供了容易受到攻击的特定版本范围。更多信息请参见 GitHub 安全公告页面。 脚本功能 脚本执行以下步骤： 1. 获取 Jenkin...

Exploit for Path Traversal in Jenkins

\ CVE-2024-23897 — Jenkins CLI Arbitrary File Read Lab \ 1...

Symlink Attack

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Symlink Attack via FilePath.untarFrom in core/src/main/java/hudson/FilePath.java. An authenticated attacker with job configuration privileges can exploit TAR extracti...

CVE-2026-70426

The Remoting component (versions 3384.v60d89463d9e0 and earlier, excluding 3355.3357.v931d3c992987 ) included in Jenkins versions 2.575 and earlier (and LTS 2.568.1 and earlier) is vulnerable to a deserialization filter bypass. The root cause is that the JEP-200 class filter is not applied to cla...

ROOT-APP-MAVEN-CVE-2026-27099 CVE-2026-27099 in io.root.org.jenkins-ci.main:jenkins-core - Patched by Root

Root has patched CVE-2026-27099 in the io.root.org.jenkins-ci.main:jenkins-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-27100 CVE-2026-27100 in io.root.org.jenkins-ci.main:jenkins-core - Patched by Root

Root has patched CVE-2026-27100 in the io.root.org.jenkins-ci.main:jenkins-core package for Root:Maven. Multiple fixed versions available...

Cross-site Scripting (XSS)

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the description field of a generic 'offline' cause set via the POST config.xml API. An attacker with Agent/Configure permission can execut...

Missing Authorization

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Authorization due to missing permission checks in the permission process. An attacker can access sensitive information about other users, such as their...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect via the from parameter in the login process. An attacker can redirect users to an attacker-controlled domain by supplying a crafted value to this...

Missing Encryption of Sensitive Data

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the handling of config.xml submissions. An attacker can access sensitive secrets stored in plaintext by obtaining Item/Extende...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect in the redirect URL handling process. An attacker can trick users into visiting malicious sites by injecting tab or newline characters between // in the...

Deserialization of Untrusted Data

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the config.xml submission process. An attacker can impersonate any user and send HTTP requests on their behalf, including...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect in the URL redirection process. An attacker can redirect users to malicious sites by crafting URLs containing relative path segments such as ./ or ../...

Missing Authorization

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Authorization due to a missing permission check in the cancel queue process. An attacker can terminate build queue items without authorization by possessing...

CVE-2026-53435

In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, a deserialization vulnerability exists in the XStream library . Attackers can submit a specially crafted config.xml file to trigger the deserialization of arbitrary types from the Jenkins core or plugins. This allows an attacker ...

UNIX Symbolic Link (Symlink) Following

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following during the extraction of .tar and .tar.gz archives when symbolic links are present. An attacker can create or overwrite arbitrary...

DNS Rebinding

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to DNS Rebinding in the origin validation process for WebSocket CLI requests due to reliance on the Host or X-Forwarded-Host HTTP headers. An attacker can bypass origin...

Cross-site Scripting (XSS)

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the UserCause function. An attacker can execute arbitrary JavaScript code in the context of other users by providing crafted input in the...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the Run Parameter values. An attacker can access information about the existence of job...

Denial Of Service (DoS)

org.jenkins-ci.main, jenkins-core is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling and closure of corrupted HTTP-based CLI connection streams, which allows an unauthenticated attacker to trigger a denial of service by sending malformed or corrupted connection...