GHSA-4JJJ-CM7Q-V6HR Jenkins Diagnostic page exposed session cookies

Jenkins shows various technical details about the current user on the /whoAmI page. In a previous fix, the Cookie header value containing the HTTP session ID was redacted. However, user metadata shown on this page could also include the HTTP session ID in Jenkins 2.218 and earlier, LTS 2.204.1 an...

jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page...

jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page...

PT-2020-15310 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.218 and earlier Jenkins LTS versions 2.204.1 and earlier Description: The issue allows attackers to obtain the HTTP session ID value from the /whoAmI page, potentially exploiting a cross-site scripting vulnerability. This...

Diagnostic web page exposed Cookie HTTP header

Jenkins shows various technical information about the current user on the /whoAmI URL. The information shown includes HTTP request headers. This allowed attackers able to exploit another cross-site scripting vulnerability to obtain the Cookie header's value even if the HttpOnly flag would prevent...