Jenkins View Encryption Bypass

Jenkins is a popular open-source automation server for building, testing, and deploying software projects. This vulnerability allows attackers with limited permissions to access encrypted password values in views, potentially leading to unauthorized access to sensitive information.

You're affected if you use A missing permission check. Affected versions: 2.528.2, 2.540 If you don't recognise this software, you're probably not affected.

1. Upgrade to Jenkins 2.540.1 or later (LTS 2.528.3 or later): https://jenkins.io/download/
2. Immediate mitigations:
3. Restrict network access to your Jenkins instance (firewall it from the public internet)
4. Audit admin account activity for suspicious access patterns
5. Monitor for unauthorized token creation

• www.jenkins.io