IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.8Hoch

CVE-2026-117624

Jenkins Project Jenkins Veröffentlicht: (vor 15 Tagen)

Beschreibung

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.

Schwachstellentyp (CWE): CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Jenkins Project Jenkins all versions

Referenzen und Patches

CPE-Treffer (NVD) (2)
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* < 2.580.2
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* < 2.588

Neue CVEs im selben Produkt — Jenkins (core)

4.3Mittel
CVE-2026-117626
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and la…

4.3Mittel
CVE-2026-117625
Jenkins Project Jenkins

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

5.4Mittel
CVE-2026-117623
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

6.1Mittel
CVE-2026-117621
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

6.1Mittel
CVE-2026-117622
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

8.1Hoch
CVE-2026-117619
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkin…