PT-2023-21410 · Jenkins · Jenkins

Published 2023-03-08 · Updated 2025-02-28 · CVE-2023-27904

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier

Description The issue potentially reveals information about Jenkins configuration that is otherwise inaccessible to attackers when an error stack trace is printed on agent-related pages due to broken agent connections.

Recommendations For Jenkins versions 2.393 and earlier, update to version 2.394 or later to resolve the issue. For Jenkins LTS versions 2.375.3 and earlier, update to version 2.375.4 or later, or to version 2.387.1 or later, to resolve the issue.

Exploit

Fix

Related Identifiers

BIT-JENKINS-2023-27904

CVE-2023-27904

GHSA-RRGP-C2W8-6VG6

RHSA-2023:1655

RHSA-2023:3195

RHSA-2023:3198

RHSA-2023:3299

RHSA-2023:3622

RHSA-2023:3663

RHSA-2023:6171

RHSA-2023:6172

RHSA-2024:0775

RHSA-2024:0778

Affected Products

Jenkins

References · 9

• 🔥 https://github.com/CVEProject/cvelist/blob/master/2023/27xxx/CVE-2023-27904.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27904 · Security Note
• https://jenkins.io/security/advisory/2023-03-08/#SECURITY-2120 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27904 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rrgp-c2w8-6vg6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2023-27904 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/40663588eea4ac953209bd8845b6b880792f92cc · Note
• https://t.me/cvenotify/112867 · Telegram Post
• https://t.me/cibsecurity/59863 · Telegram Post