Jenkins HTML Publisher Plugin up to 1.32 permission

Summaryinfo

A vulnerability was found in Jenkins HTML Publisher Plugin up to 1.32. It has been classified as critical. The impacted element is an unknown function. The manipulation leads to permission. This vulnerability is documented as CVE-2024-28151. There is not any exploit available.

Detailsinfo

A vulnerability was found in Jenkins HTML Publisher Plugin up to 1.32 (Continuous Integration Software) and classified as problematic. This issue affects an unknown code block. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality. The summary by CVE is:

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.

The weakness was released 03/06/2024. It is possible to read the advisory at jenkins.io. The identification of this vulnerability is CVE-2024-28151 since 03/05/2024. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Continuous Integration Software

Vendor

• Jenkins

Name

• HTML Publisher Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32

License

• open-source

Website

• Vendor: https://jenkins.io/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion