CVE-2022-34174
CVE-2022-34174
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
22 Jun 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
Affected products
Jenkins project · JenkinsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →