PT-2013-1872 · Cloudbees+1 · Jenkins

Soroush Dalili · Publicado 2013-02-24 · Atualizado 2022-05-14 · CVE-2012-6073

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.491 Jenkins LTS versions prior to 1.480.1 Jenkins Enterprise versions 1.424.x prior to 1.424.6.13 Jenkins Enterprise versions 1.447.x prior to 1.447.4.1 Jenkins Enterprise versions 1.466.x prior to 1.466.10.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.

Recommendations For Jenkins versions prior to 1.491, update to version 1.491 or later. For Jenkins LTS versions prior to 1.480.1, update to version 1.480.1 or later. For Jenkins Enterprise versions 1.424.x prior to 1.424.6.13, update to version 1.424.6.13 or later. For Jenkins Enterprise versions 1.447.x prior to 1.447.4.1, update to version 1.447.4.1 or later. For Jenkins Enterprise versions 1.466.x prior to 1.466.10.1, update to version 1.466.10.1 or later.

Correção

Open Redirect

RCE

Enumeração de Fraquezas

CWE-601

CWE-20

Identificadores relacionados

CVE-2012-6073

GHSA-MQGF-4RW4-2CQ2

RHSA-2013:0220

Produtos afetados

Jenkins

Referências · 8

• https://github.com/jenkinsci/jenkins · Nota
• http://cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-6073 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2013-0220.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=890608 · Nota
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20 · Nota
• https://osv.dev/vulnerability/GHSA-mqgf-4rw4-2cq2 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/12/28/1 · Nota