Jenkins Build Publisher Plugin Information Disclosure Vulnerability

Bugtraq ID:	101544
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 23 2017 12:00AM
Updated:	Oct 23 2017 12:00AM
Credit:	Steve Marlowe <[email protected]> of Cisco ASIG
Vulnerable:	Jenkins-Ci Build Publisher Plugin 1.20 Jenkins-Ci Build Publisher Plugin 1.19
Not Vulnerable:	Jenkins-Ci Build Publisher Plugin 1.22

Jenkins Build Publisher Plugin Information Disclosure Vulnerability

Build Publisher Plugin for Jenkins is prone to an information-disclosure vulnerability.

Successful exploits may allow an attacker to obtain sensitive information that may lead to further attacks.

Jenkins Build Publisher Plugin Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Jenkins Build Publisher Plugin Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jenkins Build Publisher Plugin Information Disclosure Vulnerability

References:

• Build Publisher Plugin Jenkins homepage (Jenkins)
  
• Jenkins CI Homepage (Jenkins CI)
  
• Jenkins Security Advisory 2017-10-23 (Jenkins)