Iniciar sesión
Deutsch English Español Polski
Media

Observable timing discrepancy allows determining username validity in Jenkins

  • Publicada: 24.06.2022
  • Actualizado: 11.10.2026 11:22

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames.

Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core >= 2.334, < 2.356, < 2.332.4 2.356, 2.332.4

Referencias

Puntuación CVSS 5.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Debilidad (CWE)
CWE-203, CWE-208
Plataforma
Java / Kotlin (Maven)
Paquete
org.jenkins-ci.main:jenkins-core
Publicada
24.06.2022
Actualizado
11.10.2026 11:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-9grj-j43m-mjqr - CC BY 4.0

Historial de vulnerabilidades: org.jenkins-ci.main:jenkins-core

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (259) en el archivo
Entradas en total
259
Primera → última
01.2022 06.2026
Sin corrección
1
Explotada en ataques
4

Distribución por gravedad

  • Crítica 19
  • Alta 62
  • Media 158
  • Baja 20

Divulgaciones por año

Gravedad:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    Alta · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    Alta · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    Alta · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    Alta · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    Alta · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    Alta · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability
    Alta · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Crítica · 9.8 Explotada en ataques CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    Alta · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    Alta · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    Alta · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    Alta · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    Alta · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    Alta · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    Alta · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    Alta · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    Alta · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    Alta · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Observable timing discrepancy allows determining username validity in Jenkins esta entrada
    Media · 5.3 CVE-2022-34174 >= 2.334, < 2.356, < 2.332.4 2.356, 2.332.4
  20. Unauthorized view fragment access in Jenkins
    Alta · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    Alta · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
  22. Cross-site Scripting vulnerability in Jenkins
    Alta · 8.0 CVE-2022-34172 >= 2.340, < 2.356, >= 2.332, < 2.332.4 2.356, 2.332.4
  23. Cross-site Scripting vulnerability in Jenkins
    Alta · 8.0 CVE-2022-34171 >= 2.350, < 2.356, >= 2.346, < 2.346.1, < 2.332.4 2.356, 2.346.1, 2.332.4
  24. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21686 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  25. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21685 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  26. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21689 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  27. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21690 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  28. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21692 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  29. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21693 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  30. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21694 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  31. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21688 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  32. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21691 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  33. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21687 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  34. Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
    Alta · 8.8 CVE-2021-21696 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  35. Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
    Crítica · 9.1 CVE-2021-21697 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  36. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Crítica · 9.0 CVE-2021-21695 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  37. Session fixation vulnerability in Jenkins
    Alta · 7.5 CVE-2021-21671 >= 2.292, < 2.300, < 2.289.2 2.300, 2.289.2
  38. Path traversal vulnerability in Jenkins agent names
    Alta · 8.0 CVE-2021-21605 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  39. Improper handling of REST API XML deserialization errors in Jenkins
    Alta · 8.0 CVE-2021-21604 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  40. Jenkins Cross-site Scripting vulnerability in project naming strategy
    Alta · 8.0 CVE-2020-2230 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  41. Jenkins Cross-Site Scripting vulnerability in help icons
    Alta · 8.0 CVE-2020-2229 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  42. Stored XSS vulnerability in Jenkins 'keep forever' badge icon
    Alta · 8.0 CVE-2020-2222 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  43. Stored XSS vulnerability in Jenkins upstream cause
    Alta · 8.0 CVE-2020-2221 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  44. Stored XSS vulnerability in Jenkins job build time trend
    Alta · 8.0 CVE-2020-2220 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  45. Stored XSS vulnerability in Jenkins console links
    Alta · 8.0 CVE-2020-2223 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  46. Cross-Site Request Forgery in Jenkins
    Alta · 8.8 CVE-2020-2160 < 2.204.6, >= 2.205, < 2.228 2.204.6, 2.228
  47. Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
    Alta · 8.6 CVE-2020-2099 < 2.204.2, >= 2.205, < 2.214 2.204.2, 2.214
  48. XML external entity (XXE) vulnerability in Jenkins
    Alta · 7.5 CVE-2015-1811 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  49. XML external entity (XXE) vulnerability in Jenkins
    Alta · 7.5 CVE-2015-1809 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  50. Cross-Site Request Forgery in Jenkins
    Alta · 8.8 CVE-2019-10384 < 2.176.3, >= 2.177, < 2.192 2.176.3, 2.192
  51. Cross-Site Request Forgery in Jenkins
    Alta · 7.5 CVE-2019-10353 < 2.176.2, >= 2.177, < 2.186 2.176.2, 2.186
  52. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Crítica · 9.8 CVE-2017-1000362 >= 1.498, < 2.32.2, >= 2.40, < 2.44 2.32.2, 2.44
  53. Jenkins allows Execution of Code by Opening a JRMP Listener
    Crítica · 9.8 CVE-2016-0788 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  54. Jenkins allows Deserialization of Untrusted Data via an XML File
    Alta · 8.8 CVE-2016-0792 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  55. Exposure of Sensitive Information in Jenkins Core
    Crítica · 9.8 CVE-2016-0791 < 1.650 1.650
  56. Jenkins affected by Open Redirect Vulnerability
    Alta · 7.4 CVE-2016-3726 >= 1.652, < 2.3, < 1.651.2 2.3, 1.651.2
  57. Race Condition in Jenkins
    Alta · 8.1 CVE-2017-1000503 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  58. Cross-Site Request Forgery in Jenkins
    Alta · 8.8 CVE-2017-1000356 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  59. Improper Authentication in Jenkins
    Alta · 8.8 CVE-2017-1000354 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  60. Cross-Site Request Forgery in Jenkins
    Alta · 8.1 CVE-2017-1000504 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  61. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Alta · 7.8 CVE-2018-1000410 < 2.138.2, >= 2.140, < 2.146 2.138.2, 2.146
  62. Improper Input Validation in Jenkins
    Alta · 7.5 CVE-2017-1000394 < 2.73.2, >= 2.74, < 2.84 2.73.2, 2.84
  63. Improper Input Validation in Jenkins
    Alta · 7.3 CVE-2017-1000391 < 2.73.3, >= 2.74, < 2.89 2.73.3, 2.89
  64. OS Command Injection in Jenkins
    Alta · 8.8 CVE-2017-1000393 < 2.73.2, >= 2.74, < 2.84 2.73.2, 2.84
  65. Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
    Crítica · 9.8 CVE-2016-9299 >= 2.20, < 2.32, < 2.19.3 2.32, 2.19.3
  66. Missing Release of Resource after Effective Lifetime in Jenkins
    Alta · 7.5 CVE-2018-1999043 < 2.121.3, >= 2.122, < 2.138 2.121.3, 2.138
  67. Improper Limitation of a Pathname to a Restricted Directory in Jenkins
    Alta · 8.2 CVE-2018-1000863 < 2.138.4, >= 2.140, < 2.154 2.138.4, 2.154
  68. Deserialization of Untrusted Data in Jenkins
    Alta · 8.8 CVE-2017-2608 < 2.32.2, >= 2.34, < 2.44 2.32.2, 2.44
  69. Jenkins does not Verify Checksums for Plugin Files
    Alta · 7.5 CVE-2015-7539 < 1.625.2, >= 1.626, < 1.640 1.625.2, 1.640
  70. Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
    Alta · 8.8 CVE-2015-7537 >= 1.626, < 1.640, < 1.625.2 1.640, 1.625.2
  71. Jenkins discloses project names via fingerprints
    Alta · 7.5 Explotada en ataques CVE-2015-5317 < 1.625.2, >= 1.626, < 1.638 1.625.2, 1.638
  72. Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
    Alta · 8.8 CVE-2015-7538 >= 1.626, < 1.640, < 1.625.2 1.640, 1.625.2
  73. Improper Authorization in Jenkins Core
    Alta · 7.2 CVE-2019-1003003 < 2.150.2, >= 2.151, < 2.159 2.150.2, 2.159
  74. Improper Authorization in Jenkins Core
    Alta · 7.2 CVE-2019-1003004 < 2.159 2.159
  75. Deserialization of Untrusted Data in Jenkins
    Crítica · 9.8 Explotada en ataques CVE-2017-1000353 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  76. Improper Input Validation in Jenkins
    Alta · 7.5 CVE-2018-1999002 < 2.121.2, >= 2.122, < 2.132 2.121.2, 2.132
  77. Insufficient Session Expiration in Jenkins
    Alta · 8.1 CVE-2019-1003049 < 2.164.2, >= 2.165, < 2.172 2.164.2, 2.172
  78. Path Traversal in Jenkins
    Alta · 8.1 CVE-2018-1000194 < 2.107.3, >= 2.108, < 2.121 2.107.3, 2.121
  79. Deserialization of Untrusted Data in Jenkins
    Crítica · 9.8 Explotada en ataques CVE-2018-1000861 < 2.138.4, >= 2.140, < 2.154 2.138.4, 2.154
  80. Improper Input Validation in Jenkins
    Alta · 8.8 CVE-2018-1999001 < 2.121.2, >= 2.122, < 2.132 2.121.2, 2.132
Mostrar más (2) Mostrando 80 de 82

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.