Known vulnerabilities in Jenkins
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2023-27902 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows… | 4.3 Medium | Mar 8, 2023 |
| CVE-2023-27901 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying… | 7.5 High | Mar 8, 2023 |
| CVE-2023-27900 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying… | 7.5 High | Mar 8, 2023 |
| CVE-2023-27899 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with… | 7.0 High | Mar 8, 2023 |
| CVE-2023-27898 | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins… | 9.6 Critical | Mar 8, 2023 |
| CVE-2022-41224 | Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some… | 5.4 Medium | Sep 21, 2022 |
| CVE-2022-34175 | Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby… | Not rated | Jun 22, 2022 |
| CVE-2022-34174 | In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows… | Not rated | Jun 22, 2022 |
| CVE-2022-34173 | In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without… | Not rated | Jun 22, 2022 |
| CVE-2022-34172 | In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip'… | Not rated | Jun 22, 2022 |
| CVE-2022-34171 | In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output… | Not rated | Jun 22, 2022 |
| CVE-2022-34170 | In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon… | Not rated | Jun 22, 2022 |
| CVE-2022-0538 | Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply… | Not rated | Feb 9, 2022 |
| CVE-2022-20612 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers… | Not rated | Jan 12, 2022 |
| CVE-2021-21697 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build… | Not rated | Nov 4, 2021 |
| CVE-2021-21696 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory… | Not rated | Nov 4, 2021 |
| CVE-2021-21695 | FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in… | Not rated | Nov 4, 2021 |
| CVE-2021-21694 | FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check… | Not rated | Nov 4, 2021 |
| CVE-2021-21692 | FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read'… | Not rated | Nov 4, 2021 |
| CVE-2021-21691 | Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318… | Not rated | Nov 4, 2021 |
| CVE-2021-21690 | Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path… | Not rated | Nov 4, 2021 |
| CVE-2021-21689 | FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and… | Not rated | Nov 4, 2021 |
| CVE-2021-21688 | The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and… | Not rated | Nov 4, 2021 |
| CVE-2021-21687 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links… | Not rated | Nov 4, 2021 |
| CVE-2021-21686 | File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do… | Not rated | Nov 4, 2021 |
Other Jenkins project products
Jenkins Script Security Plugin 39
Jenkins Active Directory Plugin 11
Jenkins Pipeline: Groovy Plugin 11
Jenkins Email Extension Plugin 9
Jenkins OpenId Connect Authentication Plugin 8
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins GitLab Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins OpenShift Deployer Plugin 7
Jenkins Amazon EC2 Plugin 7