BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Advisory 2024-01-24

2024-01-24 Jan 24, 2024 Source: Vendor

Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2024-01-24/. 12 SECURITY issues listed. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.jenkins.io/security/advisory/2024-01-24/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

11 lines
All 11 CVEs 10 Additional recognition 1 Unclaimed only
Showing 1–11 of 11
CVE-2024-23901 BR2024-0000-009635 SECURITY-3040 unclaimed
Shared projects are unconditionally discovered by GitLab Branch Source Plugin
Credited as Francois Marot
CVE-2024-23902 BR2024-0000-009636 SECURITY-3251 unclaimed
CSRF vulnerability in GitLab Branch Source Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2024-23900 BR2024-0000-009637 SECURITY-3289 unclaimed
Path traversal vulnerability in Matrix Project Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2024-23905 BR2024-0000-009638 SECURITY-3322 unclaimed
Content-Security-Policy protection for user content disabled by Red Hat Dependency Analytics Plugin
Credited as Pierre Beitz, CloudBees, Inc.
CVE-2024-23897 Known exploited (CISA KEV) BR2024-0000-009639 SECURITY-3314 unclaimed
Arbitrary file read vulnerability through the CLI can lead to RCE
Credited as Yaniv Nizry (SonarSource)
CVE-2024-23898 BR2024-0000-009640 SECURITY-3315 unclaimed
Cross-site WebSocket hijacking vulnerability in the CLI
Credited as Yaniv Nizry (SonarSource)
CVE-2023-6147 BR2024-0000-009641 SECURITY-3005 unclaimed
XXE vulnerability in Qualys Policy Compliance Scanning Connector Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-6148 BR2024-0000-009642 SECURITY-3006 unclaimed
Stored XSS vulnerability in Qualys Policy Compliance Scanning Connector Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
Acknowledgement BR2024-0000-009643 SECURITY-3007 unclaimed
Incorrect permission checks in Qualys Policy Compliance Scanning Connector Plugin allow capturing credentials
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2024-23903 BR2024-0000-009644 SECURITY-2871 unclaimed
Non-constant time webhook token comparison in GitLab Branch Source Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2024-23903 BR2024-0000-009645 SECURITY-2871 unclaimed
Non-constant time webhook token comparison in GitLab Branch Source Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.