PT-2018-15186 · Cloudbees+1 · Jenkins

Publicado 2018-07-23 · Atualizado 2022-06-13 · CVE-2018-1999001

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.132 and earlier Jenkins versions 2.121.1 and earlier

Description A vulnerability exists that allows unauthorized modification of configuration, enabling attackers to provide crafted login credentials. This can cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins starts without this file, it reverts to legacy defaults, granting administrator access to anonymous users.

Recommendations For Jenkins versions 2.132 and earlier, update to a version later than 2.132 to resolve the issue. For Jenkins versions 2.121.1 and earlier, update to a version later than 2.121.1 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1999001

GHSA-J8QV-MJ4R-6FW4

Produtos afetados

Jenkins

Referências · 7

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/5f4d014b3b7f89e206c6c8509540ed559f604959 · Nota
• https://osv.dev/vulnerability/CVE-2018-1999001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999001 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-07-18/#SECURITY-897 · Aviso do Fabricante
• https://oracle.com/security-alerts/cpuapr2022.html · Correção
• https://osv.dev/vulnerability/GHSA-j8qv-mj4r-6fw4 · Aviso do Fabricante