Most recent entries from all

BIT-jenkins-2023-35141

Affected: Bitnami: jenkins

In Jenkins LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

EUVD-2026-208661

fkie_cve-2023-35141

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

GHSA-98fp-r22g-wpj7 — Jenkins CSRF protection bypass vulnerability

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins provides context menus for various UI elements, like links to jobs and builds, or breadcrumbs.

As of publication of this advisory, we are aware of insufficiently escaped context menu URLs for label expressions, allowing attackers with Item/Configure permissions to exploit this vulnerability.

Jenkins 2.400, LTS 2.401.1 sends GET requests to load the list of context actions.

gsd-2023-35141

WID-SEC-W-2023-1471 — Jenkins Core und Jenkins Plugins: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.