Vulnerabilitymedium
Jenkins Security Alert: New Security Flaws Could Allow Code Execution Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27898 | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when… | 9.6 | 2% | ||
| CVE-2023-27905 | Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored… | 9.6 | 2% |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Mar 08, 2023 Open Source / Automation Tool A pair of severe security vulnerabilities have been disclosed in the Jenkins open source automation server that could lead to code execution on targeted systems. The flaws, tracked as CVE-2023-27898 and CVE-2023-27905 , impact the Jenkins server and Update Center, and have been collectively christened CorePlague by cloud security firm Aqua.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.