description: In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
affected:
{
product: Jenkins
vendor: Jenkins project
versions:
lessThanOrEqual: 2.355, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: LTS 2.332.3, status: affected, version: unspecified, versionType: custom
}