[NEU] [hoch] Jenkins: Mehrere Schwachstellen
BSI flags multiple high-severity Jenkins and plugin vulnerabilities — including RCE and session hijacking — that could let attackers poison CI/CD pipelines from the outside.
Summary written by editorial AI · Source link below
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Jenkins und verschiedenen Plugins ausnutzen, um Daten offenzulegen oder zu manipulieren, Cross-Site Scripting (XSS) durchzuführen, beliebigen Code auszuführen oder die Sitzung eines anderen Benutzers zu übernehmen.
Editorial Analysis
A compromised Jenkins instance is a direct path to supply-chain attacks; these flaws allow unauthenticated attackers to execute code and hijack sessions on the build server.
Patch Jenkins core and all listed plugins immediately, restrict controller network access, and rotate credentials stored in Jenkins.
Vulnerabilities in the widely used Jenkins CI/CD platform could allow external attackers to tamper with software builds — immediate patching is required.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at CERT-Bund (BSI) in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d