Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 6 |
CVE-ID | CVE-2020-2105 CVE-2020-2104 CVE-2020-2103 CVE-2020-2102 CVE-2020-2101 CVE-2020-2100 |
CWE-ID | CWE-451 CWE-200 CWE-310 CWE-399 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Jenkins Server applications / Application servers Jenkins LTS Server applications / Application servers |
Vendor | Jenkins |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
EUVDB-ID: #VU24764
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-2105
CWE-ID:
CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a clickjacking attack
The vulnerability exists due to the affected software does not serve the "X-Frame-Options: deny" HTTP header on REST API responses to protect against clickjacking attacks. A remote attacker can rout the victim through a specially crafted web page that embeds a REST API endpoint in an iframe and trick the user to perform an action which would allow for the attacker to learn the content of that REST API endpoint.
MitigationInstall updates from vendor's website.
Vulnerable software versionsJenkins: 2.0 - 2.218
Jenkins LTS: 2.7.1 - 2.204.1
External linkshttp://www.openwall.com/lists/oss-security/2020/01/29/1
http://jenkins.io/security/advisory/2020-01-29/#SECURITY-1704
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU24763
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-2104
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to the access to the chart requires no permissions beyond the general Overall/Read. A remote user with Overall/Read permission can gain unauthorized access to JVM memory usage data.
MitigationInstall updates from vendor's website.
Vulnerable software versionsJenkins: 2.0 - 2.218
Jenkins LTS: 2.7.1 - 2.204.1
External linkshttp://www.openwall.com/lists/oss-security/2020/01/29/1
http://jenkins.io/security/advisory/2020-01-29/#SECURITY-1650
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU24762
Risk: Low
CVSSv3.1: 3.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-2103
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected software exposes session identifiers on a user's detail object in the "/whoAmI" diagnostic page. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.
Install updates from vendor's website.
Vulnerable software versionsJenkins: 2.0 - 2.218
Jenkins LTS: 2.7.1 - 2.204.1
External linkshttp://www.openwall.com/lists/oss-security/2020/01/29/1
http://jenkins.io/security/advisory/2020-01-29/#SECURITY-1695
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU24761
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-2102
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected software does not use a constant-time comparison when checking whether two HMACs are equal. A remote authenticated attacker can use statistical methods to obtain a valid HMAC for an attacker-controlled input value.
MitigationInstall updates from vendor's website.
Vulnerable software versionsJenkins: 2.0 - 2.218
Jenkins LTS: 2.7.1 - 2.204.1
External linkshttp://www.openwall.com/lists/oss-security/2020/01/29/1
http://jenkins.io/security/advisory/2020-01-29/#SECURITY-1660
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU24760
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-2101
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected software does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. A remote authenticated attacker can use statistical methods to obtain the connection secret.
MitigationInstall updates from vendor's website.
Vulnerable software versionsJenkins: 2.0 - 2.218
Jenkins LTS: 2.7.1 - 2.204.1
External linkshttp://www.openwall.com/lists/oss-security/2020/01/29/1
http://jenkins.io/security/advisory/2020-01-29/#SECURITY-1659
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU24759
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-2100
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the UDP multicast/broadcast service can be used in an amplification reflection attack. A remote attacker can send spoofed UDP packets and cause a denial of service condition on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsJenkins: 2.0 - 2.218
Jenkins LTS: 2.7.1 - 2.204.1
External linkshttp://www.openwall.com/lists/oss-security/2020/01/29/1
http://jenkins.io/security/advisory/2020-01-29/#SECURITY-1641
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.