Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• jenkins jenkinsup to 2.204.1 inclusive
• jenkins jenkinsup to 2.218 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (jenkins). Independent of NVD's CPE analysis and usually ahead of it.

• Jenkins project Jenkins

  • unspecified and later · up to and including 2.218affected
  • unspecified and later · up to and including LTS 2.204.1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloKEV
  99Now
• CVE-2017-1000353Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.KEV
  99Now
• CVE-2018-1000861A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/corKEV
  98Now

Published before and after this one in the same product

• ← EarlierCVE-2020-2101Jan 29, 2020 · Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which
  21Monitor
• ← EarlierCVE-2020-2102Jan 29, 2020 · Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
  21Monitor
• Later →CVE-2020-2104Jan 29, 2020 · Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.
  17Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.