Information Exposure Vulnerability in Jenkins by Cloudbees

CVE-2017-2606

What is CVE-2017-2606?

Jenkins, a popular automation server, is susceptible to a vulnerability that enables unprivileged anonymous users to retrieve item names via an unprotected section of the internal API. This flaw, linked to SECURITY-380, allows unauthorized access, potentially exposing sensitive information that should remain confidential. Users should upgrade to the latest versions of Jenkins to mitigate the risk of unauthorized information retrieval through this API vulnerability.

References