Threats tagged 'ghsa-vrqw-5jr7-wx5r'

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a vulnerability in the HTTP endpoint used for creating the first user account. This endpoint does not verify whether the setup wizard has been completed, leading to a race condition. An unauthenticated attacker can exploit this flaw to create an administrator account during the initial user account replacement process.