CVE-2024-43044

CVE-2024-43044 説明 このスクリプトは、JenkinsインスタンスからJenkinsバージョンを取得し、既知の脆弱性のあるバージョン範囲と比較することで、CVE-2024-43044に対するJenkinsインスタンスをチェックします。 CVE-2024-43044 : この脆弱性はJenkinsコアおよびremotingバージョンに影響し、攻撃者が特定のJenkinsバージョンを悪用することを可能にします。このCVEの詳細はこちらで確認できます。 GHSA-h856-ffvv-xvr4 :...

Symlink Attack

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Symlink Attack via FilePath.untarFrom in core/src/main/java/hudson/FilePath.java. An authenticated attacker with job configuration privileges can exploit TAR extracti...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

ROOT-APP-MAVEN-CVE-2026-27099 CVE-2026-27099 in io.root.org.jenkins-ci.main:jenkins-core - Patched by Root

Root has patched CVE-2026-27099 in the io.root.org.jenkins-ci.main:jenkins-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-27100 CVE-2026-27100 in io.root.org.jenkins-ci.main:jenkins-core - Patched by Root

Root has patched CVE-2026-27100 in the io.root.org.jenkins-ci.main:jenkins-core package for Root:Maven. Multiple fixed versions available...

Cross-site Scripting (XSS)

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the description field of a generic 'offline' cause set via the POST config.xml API. An attacker with Agent/Configure permission can execut...

Missing Authorization

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Authorization due to missing permission checks in the permission process. An attacker can access sensitive information about other users, such as their...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect via the from parameter in the login process. An attacker can redirect users to an attacker-controlled domain by supplying a crafted value to this...

Missing Encryption of Sensitive Data

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the handling of config.xml submissions. An attacker can access sensitive secrets stored in plaintext by obtaining Item/Extende...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect in the redirect URL handling process. An attacker can trick users into visiting malicious sites by injecting tab or newline characters between // in the...

Deserialization of Untrusted Data

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the config.xml submission process. An attacker can impersonate any user and send HTTP requests on their behalf, including...

Missing Authorization

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Authorization due to a missing permission check in the cancel queue process. An attacker can terminate build queue items without authorization by possessing...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect in the URL redirection process. An attacker can redirect users to malicious sites by crafting URLs containing relative path segments such as ./ or ../...

CVE-2026-53435

In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, a deserialization vulnerability exists in the XStream library . Attackers can submit a specially crafted config.xml file to trigger the deserialization of arbitrary types from the Jenkins core or plugins. This allows an attacker ...

UNIX Symbolic Link (Symlink) Following

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following during the extraction of .tar and .tar.gz archives when symbolic links are present. An attacker can create or overwrite arbitrary...

DNS Rebinding

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to DNS Rebinding in the origin validation process for WebSocket CLI requests due to reliance on the Host or X-Forwarded-Host HTTP headers. An attacker can bypass origin...

Cross-site Scripting (XSS)

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the UserCause function. An attacker can execute arbitrary JavaScript code in the context of other users by providing crafted input in the...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the Run Parameter values. An attacker can access information about the existence of job...

Denial Of Service (DoS)

org.jenkins-ci.main, jenkins-core is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling and closure of corrupted HTTP-based CLI connection streams, which allows an unauthenticated attacker to trigger a denial of service by sending malformed or corrupted connection...

Insufficiently Protected Credentials

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the display of build authorization tokens on the job configuration form. An attacker can gain unauthorized access to sensitive...