Jenkins Exclusion Plugin allows Access to Resource Locks

MEDIUM 5.5CVE-2013-6373 · GHSA-2q8v-439j-6p77 · Published 25/11/2013 · updated 17/06/2026

In short

CVE-2013-6373 is a MEDIUM (CVSS 5.5) vulnerability affecting org.jenkins-ci.plugins:exclusion, exclusion (jenkins-ci).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.8% of all vulnerabilities.
Fix: update to 0.9 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:exclusion Maven	`< 0.9`	`0.9`
exclusion jenkins-ci	`= 0.6= 0.7≤ 0.8`	No fix yet

Description

The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.

NVD description

The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2013-6373 · ADVISORY
jenkinsci/exclusion-plugin commit 847f9ae · WEB
jenkinsci/exclusion-plugin · PACKAGE
wiki.jenkins-ci.org/display/JENKINS/Exclusion-Plugin · WEB
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free