CVE-2018-1999044: Loop with Unreachable Exit Condition

A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop...

PT-2018-15225

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.137 Jenkins versions 2.121.2 and earlier Description A sensitive information exposure issue exists in Computer.java, allowing attackers with Overall/Read permission to access the connection log for any agent...

Unauthorized users could access agent logs

Users with Overall/Read permission were able to access the URL serving agent logs on the UI due to a lack of permission checks. Access to the affected URL is now limited to users with the correct Agent/Connect permission...

CVE-2018-1999032: Improper Privilege Management

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

PT-2018-15211

Name of the Vulnerable Software and Affected Versions Jenkins Agiletestware Pangolin Connector for TestRail Plugin versions 2.1 and earlier Description A data modification issue exists that allows attackers with Overall/Read permission to override the plugin's configuration by sending crafted HTT...

CVE-2018-1999003

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds...

CloudBees Jenkins Unauthorized Operation Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...

CVE-2017-2652

It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all...

PT-2018-7160

Name of the Vulnerable Software and Affected Versions: Jenkins Distributed Fork plugin version 1.5.0 and earlier Description: A security issue was discovered in the Distributed Fork plugin for Jenkins, where permission checks were not properly performed before and including version 1.5.0. This...

CVE-2018-1999004

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches...

CVE-2018-1999003

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds...

CVE-2018-1999004

The connected sources confirm CVE-2018-1999004 is an improper authorization flaw in Jenkins prior to version 2.133 (and prior to 2.132/2.121.1 as cited by various records) affecting SlaveComputer.java, where users with Overall/Read permission can initiate agent launches and abort in-progress laun...

CVE-2018-1999003

CVE-2018-1999003 affects Jenkins versions up to 2.133 (and 2.132/2.121.1 and earlier) where the Queue.java path fails to enforce privileges. This allows attackers with Overall/Read permission to cancel queued builds. The issue is rooted in improper authorization logic for queue operations. Impact...

Unauthorized users could initiate and abort agent launches

The URL that initiates agent launches on the Jenkins controller did not perform a permission check, allowing users with Overall/Read permission to initiate agent launches. Doing so canceled all ongoing launches for the specified agent, so this allowed attackers to prevent an agent from launching...

CVE-2018-1000606

A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL...

CVE-2018-1000603

A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCleanupThread.java, JCloudsCloud.java, JCloudsComputer.java, JCloudsPreCreationThread.java, JCloudsRetentionStrategy.java, JCloudsSlave.java,...

CVE-2018-1000609

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration...

PT-2018-9464

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 0.7-alpha and earlier Description A sensitive information exposure issue exists in the Jenkins Configuration as Code Plugin, specifically in ConfigurationAsCode.java, allowing attackers with...

CVE-2018-1000609: Exposure of Sensitive Information to an Unauthorized Actor

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration...

CVE-2018-1000603: Exposure of Sensitive Information to an Unauthorized Actor

A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCleanupThread.java, JCloudsCloud.java, JCloudsComputer.java, JCloudsPreCreationThread.java, JCloudsRetentionStrategy.java, JCloudsSlave.java,...