Subject: Sensitive Information Disclosure

From: Nitish Singh <[email-masked]>
Date: Thu, 11 Mar 2021 08:22:55 +0530

Package: JENKINS SERVER
Version: 2.194
Severity: HIGH

Summary
I found a Jenkins server running on the public internet which is easy to
access and get sensitive information.

Steps To Reproduce
1. Visit the link https://46.105.191.79/  there is options to sign up.
2. You will get access to all the projects to check the files and check
their users.
3. If a hacker gets access to the .git file he uses and does something
against your organisation.

POC video is attached to this email.