IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.3Yüksek

CVE-2026-84652

Jenkins Project Jenkins Yayım: (2 ay önce)

Açıklama

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

Zayıflık türü (CWE): CWE-384

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Jenkins Project Jenkins all versions

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (2)
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* < 2.568.3
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* < 2.580

Aynı üründe son açıklar — Jenkins (core)

4.3Orta
CVE-2026-117626
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and la…

8.8Yüksek
CVE-2026-117624
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypas…

4.3Orta
CVE-2026-117625
Jenkins Project Jenkins

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

5.4Orta
CVE-2026-117623
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

6.1Orta
CVE-2026-117621
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

6.1Orta
CVE-2026-117622
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.