CVE-2018-1000169

jenkins: CLI leaked existence of views and agents with attacker-specified names to users without Overall/Read permission (SECURITY-754)

Published Apr 13, 2018 CVSS 3.0 · 5.3 Medium EPSS 1.4% KEV · Not listed
Description
An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-3608 An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins.
Github GHSA Github GHSA GHSA-cpw3-x7gf-p872 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 5, 2024, 12:33 PM
Reserved
Apr 13, 2018, 12:00 AM
Status
Modified
Published
Apr 16, 2018, 9:58 AM
Modified
Jun 17, 2026, 1:32 AM
Severity
Low
Public date
Apr 11, 2018, 12:00 AM