Most recent entries from all

BIT-jenkins-2023-27902

Affected: Bitnami: jenkins

Jenkins LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.

EUVD-2026-219965

fkie_cve-2023-27902

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.

GHSA-cj6r-8pxj-5jv6 — Incorrect Permission Preservation in Jenkins Core

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins uses temporary directories adjacent to workspace directories, usually with the @tmp name suffix, to store temporary files related to the build. In pipelines, these temporary directories are adjacent to the current working directory when operating in a subdirectory of the automatically allocated workspace. Jenkins-controlled processes, like SCMs, may store credentials in these directories.

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 shows these temporary directories when viewing job workspaces, which allows attackers with Item/Workspace permission to access their contents.

Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 does not list these temporary directories in job workspaces.

As a workaround, do not grant Item/Workspace permission to users who lack Item/Configure permission, if you’re concerned about this issue but unable to immediately update Jenkins.

gsd-2023-27902

RHSA-2023:3299 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization kubernetes-client: Insecure deserialization in unmarshalYaml method jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode springframework: Authorization Bypass in RegexRequestMatcher com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin FileUpload: FileUpload DoS with excessive parts jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin Jenkins: Denial of Service attack Jenkins: Denial of Service attack Jenkins: Workspace temporary directories accessible through directory browser Jenkins: Information disclosure through error stack traces related to agents

WID-SEC-W-2023-0609 — Jenkins: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen und Code auszuführen