# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2022-41224 |
79 |
|
XSS |
2022-09-21 |
2022-09-22 |
0.0 |
None |
??? |
??? |
??? |
??? |
??? |
??? |
Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component. |
2 |
CVE-2022-34175 |
|
|
Bypass |
2022-06-23 |
2022-10-20 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view. |
3 |
CVE-2022-34174 |
203 |
|
|
2022-06-23 |
2022-06-29 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. |
4 |
CVE-2022-34173 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
5 |
CVE-2022-34172 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability. |
6 |
CVE-2022-34171 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability. |
7 |
CVE-2022-34170 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
8 |
CVE-2022-20612 |
352 |
|
CSRF |
2022-01-12 |
2022-07-29 |
2.6 |
None |
Remote |
High |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set. |
9 |
CVE-2022-2048 |
400 |
|
DoS |
2022-07-07 |
2022-10-25 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. |
10 |
CVE-2022-0538 |
502 |
|
|
2022-02-09 |
2022-02-11 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage. |
11 |
CVE-2021-28165 |
755 |
|
|
2021-04-01 |
2022-07-29 |
7.8 |
None |
Remote |
Low |
Not required |
None |
None |
Complete |
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. |
12 |
CVE-2021-21697 |
184 |
|
|
2021-11-04 |
2021-11-08 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
None |
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions. |
13 |
CVE-2021-21696 |
693 |
|
Exec Code |
2021-11-04 |
2021-11-08 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process. |
14 |
CVE-2021-21695 |
59 |
|
|
2021-11-04 |
2022-10-24 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
15 |
CVE-2021-21694 |
862 |
|
|
2021-11-04 |
2021-11-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
16 |
CVE-2021-21693 |
863 |
|
|
2021-11-04 |
2022-12-07 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
17 |
CVE-2021-21692 |
863 |
|
|
2021-11-04 |
2021-11-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'. |
18 |
CVE-2021-21691 |
863 |
|
|
2021-11-04 |
2021-11-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
19 |
CVE-2021-21690 |
693 |
|
Bypass |
2021-11-04 |
2021-11-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
20 |
CVE-2021-21689 |
|
|
|
2021-11-04 |
2022-10-24 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
None |
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
21 |
CVE-2021-21688 |
862 |
|
|
2021-11-04 |
2021-11-05 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo). |
22 |
CVE-2021-21687 |
862 |
|
|
2021-11-04 |
2021-11-08 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
None |
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar. |
23 |
CVE-2021-21686 |
59 |
|
|
2021-11-04 |
2021-11-08 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories. |
24 |
CVE-2021-21685 |
862 |
|
|
2021-11-04 |
2021-11-08 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
None |
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. |
25 |
CVE-2021-21671 |
384 |
|
|
2021-06-30 |
2021-07-06 |
5.1 |
None |
Remote |
High |
Not required |
Partial |
Partial |
Partial |
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. |
26 |
CVE-2021-21670 |
863 |
|
|
2021-06-30 |
2021-07-06 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. |
27 |
CVE-2021-21640 |
240 |
|
|
2021-04-07 |
2021-04-13 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names. |
28 |
CVE-2021-21639 |
20 |
|
|
2021-04-07 |
2021-04-13 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type. |
29 |
CVE-2021-21615 |
367 |
|
|
2021-01-26 |
2021-02-02 |
3.5 |
None |
Remote |
Medium |
??? |
Partial |
None |
None |
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition. |
30 |
CVE-2021-21611 |
79 |
|
XSS |
2021-01-13 |
2021-01-15 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types. |
31 |
CVE-2021-21610 |
79 |
|
XSS |
2021-01-13 |
2021-01-15 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup. |
32 |
CVE-2021-21609 |
863 |
|
|
2021-01-13 |
2021-01-15 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission. |
33 |
CVE-2021-21608 |
79 |
|
XSS |
2021-01-13 |
2021-01-15 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels. |
34 |
CVE-2021-21607 |
770 |
|
|
2021-01-13 |
2021-01-15 |
4.0 |
None |
Remote |
Low |
??? |
None |
None |
Partial |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors. |
35 |
CVE-2021-21606 |
20 |
|
|
2021-01-13 |
2021-01-15 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path. |
36 |
CVE-2021-21605 |
22 |
|
Dir. Trav. |
2021-01-13 |
2022-10-24 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file. |
37 |
CVE-2021-21604 |
502 |
|
|
2021-01-13 |
2021-01-15 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator. |
38 |
CVE-2021-21603 |
79 |
|
XSS |
2021-01-13 |
2021-01-15 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability. |
39 |
CVE-2021-21602 |
59 |
|
|
2021-01-13 |
2021-01-15 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks. |
40 |
CVE-2020-2251 |
319 |
|
|
2020-09-01 |
2020-09-04 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure. |
41 |
CVE-2020-2231 |
79 |
|
XSS |
2020-08-12 |
2022-10-28 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token. |
42 |
CVE-2020-2230 |
79 |
|
XSS |
2020-08-12 |
2022-10-05 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission. |
43 |
CVE-2020-2229 |
79 |
|
XSS |
2020-08-12 |
2022-10-05 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability. |
44 |
CVE-2020-2223 |
79 |
|
XSS |
2020-07-15 |
2020-07-21 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability. |
45 |
CVE-2020-2222 |
79 |
|
XSS |
2020-07-15 |
2020-07-21 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability. |
46 |
CVE-2020-2221 |
79 |
|
XSS |
2020-07-15 |
2020-07-21 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability. |
47 |
CVE-2020-2220 |
79 |
|
XSS |
2020-07-15 |
2020-07-21 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability. |
48 |
CVE-2020-2163 |
79 |
|
XSS |
2020-03-25 |
2020-03-27 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers. |
49 |
CVE-2020-2162 |
79 |
|
XSS |
2020-03-25 |
2020-03-27 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability. |
50 |
CVE-2020-2161 |
79 |
|
XSS |
2020-03-25 |
2020-03-30 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels. |