Jenkins Project Jenkins vulnerabilities, page 2
74 vulnerabilities
Known vulnerabilities in Jenkins Project Jenkins, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-21693jenkins projectjenkins+2
EPSS score1.55%
When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21687jenkins projectjenkins+2EPSS score1.43%
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.CVE-2021-21695jenkins projectjenkins+2EPSS score2.15%
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21640jenkins projectjenkins+2EPSS score1.91%
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.CVE-2021-21670jenkins projectjenkins+2EPSS score2.04%
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.CVE-2021-21615jenkins projectjenkins+2EPSS score0.91%
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.CVE-2021-21683jenkins projectjenkins+2EPSS score2.17%
The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.CVE-2021-21682jenkins projectjenkins+2EPSS score1.00%
Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.CVE-2021-21606jenkins projectjenkins+2EPSS score1.23%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.CVE-2021-21605jenkins projectjenkins+2EPSS score2.25%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.CVE-2020-2223jenkins projectjenkins+2EPSS score1.03%
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.CVE-2020-2100jenkins projectjenkins+2EPSS score3.44%
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.CVE-2020-2221jenkins projectjenkins+2EPSS score1.08%
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.CVE-2020-2162jenkins projectjenkins+2EPSS score1.16%
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.CVE-2020-2220jenkins projectjenkins+2EPSS score1.02%
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.CVE-2020-2160jenkins projectjenkins+2EPSS score2.04%
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.CVE-2020-2163jenkins projectjenkins+2EPSS score1.16%
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.CVE-2020-2104jenkins projectjenkins+2EPSS score1.07%
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.CVE-2020-2105jenkins projectjenkins+2EPSS score1.85%
REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.CVE-2020-2230jenkins projectjenkins+2EPSS score82.73%
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.