Homepage
About Snyk

Information Exposure Affecting org.jenkins-ci.main:jenkins-core package, versions [2.334,2.356)

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.15% (51st percentile)
Expand this section
NVD
7.5 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-3157942
  • published 6 Dec 2022
  • disclosed 24 Jun 2022
  • credit Anders Lundman
Report a new vulnerability Found a mistake?

Introduced: 24 Jun 2022

CVE-2022-34174 Open this link in a new tab
CWE-203 Open this link in a new tab
CWE-208 Open this link in a new tab

How to fix?

Upgrade org.jenkins-ci.main:jenkins-core to version 2.356 or higher.

Overview

org.jenkins-ci.main:jenkins-core is an open source automation server.

Affected versions of this package are vulnerable to Information Exposure due to an observable timing discrepancy between login attempts with an invalid username and login attempts with a valid username but wrong password, when using the Jenkins user database security realm.