Jenkins Missing Permission Check Vulnerability Allows Unauthorized Access to Agent Configurations

A vulnerability exists in Jenkins versions through 2.503 and LTS versions through 2.492.2, where a missing permission check allows attackers with Computer/Create permission, but without Computer/Extended Read permission, to copy an agent and access its configuration. This issue arises from an HTTP endpoint that does not properly validate permissions before allowing the copying of agent data.

Impact

Exploitation of this vulnerability allows unauthorized users to access sensitive agent configuration details, potentially including secrets or other confidential information.

Remediation

Users should update to Jenkins version 2.504 or LTS version 2.492.3, both of which include the necessary permission checks to prevent unauthorized access to agent configurations.