A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
Scores
Version
Score
Vecteur
Évalué par
CVSS 3.1
MEDIUM 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD · nvd@nist.gov (Primary)
CVSS 2.0
MEDIUM 4.0
AV:N/AC:L/Au:S/C:P/I:N/A:N
NVD · nvd@nist.gov (Primary)
Avis
GHSA-2w4x-rxp7-grg7 — Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
