U.S. Dept Of Defense · Report #2178941
Unauthenticated Jenkins instance exposed information related to █████
Validstatus
highseverity
38upvotes
26 Jan 2024disclosed
Summary
An unauthenticated Jenkins instance hosted in AWS GovCloud exposed some information regarding US Department of Defense. The DOD team promptly acknowledged and fixed this issue.
How it was found
Affected URLs - ██████████blue/organizations/jenkins/pipelines ████████
██████████
████
Also notice that the information is transmitted in clear text as the server is running on HTTP.
Impact
An attacker can read or edit sensitive information belonging to █████ by abusing this vulnerability.
System Host(s)
███████
Affected Product(s) and Version(s)
CVE Numbers
Steps to Reproduce
Navigate to ███████ , and other sections. It is exposing information related to ███
Suggested Mitigation/Remediation Actions
It is recommended to Implement authentication on this Jenkins instance