Subject: Bug#566 closed by Mark Hindley <[email-masked]> (closing 566)

From: [email-masked] (Devuan Bug Tracking System)
Date: Tue, 24 Jan 2023 18:12:01 +0000

This is an automatic notification regarding your bug report
which was filed against the jenkins server package:

#566: Sensitive Information Disclosure

It has been closed by Mark Hindley <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mark Hindley <[email-masked]> by
replying to this email.

-- 
Devuan Bug Tracking System
Contact [email-masked] with problems

Subject: closing 566
From: Mark Hindley <[email-masked]>
To: [email-masked]
Date: Tue, 24 Jan 2023 18:10:21 +0000

close 566 
thanks

Subject: Sensitive Information Disclosure
From: Nitish Singh <[email-masked]>
To: [email-masked]
Date: Thu, 11 Mar 2021 08:22:55 +0530

Package: JENKINS SERVER
Version: 2.194
Severity: HIGH

Summary
I found a Jenkins server running on the public internet which is easy to
access and get sensitive information.

Steps To Reproduce
1. Visit the link https://46.105.191.79/  there is options to sign up.
2. You will get access to all the projects to check the files and check
their users.
3. If a hacker gets access to the .git file he uses and does something
against your organisation.

POC video is attached to this email.