Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. CloudBees credited Antoine Ruffino, Daniel Beck, and XBOW for discovering these issues, reaffirming the critical role of coordinated disclosure in maintaining CI/CD ecosystem security. These flaws, patched in versions 2.500 (weekly) and 2.492.2 (LTS), affect earlier releases, including Jenkins 2.499 and LTS 2.492.1. Potential impacts range from credential theft to phishing campaigns. This bypasses Jenkins’ security controls to mask sensitive data, exposing credentials like API keys, database passwords, and cryptographic tokens. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. While Jenkins redacts secrets for users lacking Agent/Configure or View/Configure permissions, earlier versions failed to enforce this during API/CLI interactions. Attackers with Agent/Extended Read or View/Read permissions could exploit REST API or CLI endpoints to retrieve config.xml files containing unredacted secrets. As Jenkins remains a high-value target for supply chain attacks, proactive patch management and least-privilege access controls are imperative. The vulnerability underscores flawed endpoint design—Jenkins historically permitted GET methods for widget state changes, neglecting CSRF token validation. She is covering various cyber security incidents happening in the Cyber Space. Exploiting this, attackers could inject arbitrary strings into victims’ user profiles, creating persistence mechanisms for stored XSS or data exfiltration. The patch enforces POST requests, aligning with REST security best practices. This facilitates phishing by redirecting users to malicious domains under the guise of Jenkins internal links. CloudBees engineers linked these flaws to SECURITY-266, a 2016 vulnerability involving similar exposure vectors. Post-patch, Jenkins 2.500/LTS 2.492.2 rejects such URLs, mitigating phishing risks.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 07 Mar 2025 12:25:08 +0000