PT-2015-5452 · Cloudbees+1 · Jenkins

Daniel Beck · Publicado 2015-10-16 · Atualizado 2022-05-17 · CVE-2015-1810

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Média

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.600 Jenkins LTS versions prior to 1.596.1

Description The issue allows remote attackers to gain privileges by creating a reserved name, due to the HudsonPrivateSecurityRealm class not restricting access to reserved names when using the "Jenkins' own user database" setting.

Recommendations For versions prior to 1.600, update to version 1.600 or later. For LTS versions prior to 1.596.1, update to version 1.596.1 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-264

CWE-287

Identificadores relacionados

CVE-2015-1810

GHSA-37WM-28RM-56VW

RHSA-2015:1844

RHSA-2016:0070

Produtos afetados

Jenkins

Referências · 7

• https://github.com/jenkinsci/jenkins · Nota
• https://osv.dev/vulnerability/GHSA-37wm-28rm-56vw · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-1844.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2016:0070 · Aviso do Fabricante
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1205627 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1810 · Nota de Segurança