Jenkins provides read access to anonymous visitors

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_50
Category	IAM
Severity	MEDIUM

Impact

Anonymous visitors with network access to the Jenkins instance has read access to it without being required to authenticate, allowing anonymous attackers to expose information on the instance, such as: • Console outputs of executed jobs. • Job names. • Credentials IDs. • Registered users. • Available nodes.

Recommended Solution - Buildtime

Prevent anonymous visitors from having read access on the Jenkins instance.

1. On the Jenkins instance, under Manage Jenkins, browse to Configure Global Security.
2. Under Authorization, uncheck the Allow anonymous read access checkbox.