CVE-2022-34174

Description

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

1.929

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities are fixed in Jenkins-Core 2.356	Windows
Vulnerabilities CVE-2022-34170,CVE-2022-34171,CVE-2022-34172,CVE-2022-34174 are fixed in Jenkins-Core 2.332.4	Windows
Multiple vulnerabilities are fixed in Jenkins-Core for Linux 2.356	Linux
Vulnerabilities CVE-2022-34170,CVE-2022-34171,CVE-2022-34172,CVE-2022-34174 are fixed in Jenkins-Core for Linux 2.332.4	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234