CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2598
https://notcve.org/view.php?id=CVE-2017-2598
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304). Jenkins en versiones anteriores a la 2.44 y la 2.32.2 emplea el modo de cifrado en bloque AES ECB sin IV para cifrar secretos, lo que hace que Jenkins y los secretos almacenados sean vulnerables a riesgos innecesarios (SECURITY-304). • http://www.securityfocus.com/bid/95948 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2598 https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b https://jenkins.io/security/advisory/2017-02-01 • CWE-325: Missing Cryptographic Step CWE-326: Inadequate Encryption Strength •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2609
https://notcve.org/view.php?id=CVE-2017-2609
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to. Jenkins en versiones anteriores a la 2.44 y 2.32.2 es vulnerable a una divulgación de información en las sugerencias de búsqueda (SECURITY-385). La característica de autocompletado en la caja de búsqueda revela los nombres de las vistas en sus sugerencias, incluyendo aquellas para las que el usuario actual no tiene acceso. • http://www.securityfocus.com/bid/95964 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2609 https://github.com/jenkinsci/jenkins/commit/13905d8224899ba7332fe9af4e330ea96a2ae319 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2607
https://notcve.org/view.php?id=CVE-2017-2607
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs. Jenkins en versiones anteriores a la 2.44, 2.32.2 es vulnerable a Cross-Site Scripting (XSS) persistente en las notas de la consola (SECURITY-382). Jenkins permite que los plugins anoten registros de build, añadiendo nuevo contenido o cambiando la presentación del contenido ya existente mientras se ejecuta la build. • http://www.securityfocus.com/bid/95963 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2607 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2613
https://notcve.org/view.php?id=CVE-2017-2613
jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406). Jenkins en versiones anteriores a la 2.44 y 2.32.2 es vulnerable a Cross-Site Request Forgery (CSRF) de creación de usuarios mediante el uso de GET por parte de los administradores. Aunque este registro de usuarios solo se retiene hasta el reinicio en la mayoría de casos, los navegadores web de los administradores se podrían manipular para crear un gran número de registros de usuario (SECURITY-406). • http://www.securityfocus.com/bid/95967 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613 https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601 https://jenkins.io/security/advisory/2017-02-01 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2603
https://notcve.org/view.php?id=CVE-2017-2603
Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362). Jenkins en versiones anteriores a la 2.44 y 2.32.2 es vulnerable a una fuga de datos de usuario en la API config.xml de los agentes desconectados. Esto podría filtrar datos sensibles como tokens de API (SECURITY-362). • http://www.securityfocus.com/bid/95955 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2603 https://github.com/jenkinsci/jenkins/commit/3cd946cbef82c6da5ccccf3890d0ae4e091c4265 https://jenkins.io/security/advisory/2017-02-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-325: Missing Cryptographic Step •