PT-2015-6856 · Cloudbees+1 · Jenkins

Oleg Nenashev · Publicado 2015-11-25 · Atualizado 2022-05-13 · CVE-2015-5323

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.638 Jenkins LTS versions prior to 1.625.2

Description The issue allows remote administrators to potentially gain privileges and run scripts by using an API token of another user, due to improper access restrictions to API tokens.

Recommendations For Jenkins versions prior to 1.638, update to version 1.638 or later. For Jenkins LTS versions prior to 1.625.2, update to version 1.625.2 or later.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-264

CWE-522

Identificadores relacionados

CVE-2015-5323

GHSA-X4M5-J4X4-4WJG

RHSA-2016:0070

RHSA-2016:0489

Produtos afetados

Jenkins

Referências · 7

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/b3f16489ad5f15c3e749ed066cf6b4251f6668c6 · Nota
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2016:0070 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5323 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-x4m5-j4x4-4wjg · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-0489.html · Aviso do Fabricante