PT-2018-5167 · Cloudbees+1 · Jenkins

Steve Marlowe · Publicado 2018-01-29 · Atualizado 2022-05-14 · CVE-2017-1000356

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.56 and earlier Jenkins version 2.46.1 LTS and earlier

Description The issue exists in the Jenkins user database authentication realm. It allows creating an account if signup is enabled, or creating an account if the victim is an administrator. This could possibly delete the existing default admin user, allowing a wide variety of impacts.

Recommendations For Jenkins versions 2.56 and earlier, update to a version later than 2.56 to resolve the issue. For Jenkins version 2.46.1 LTS and earlier, update to a version later than 2.46.1 LTS to resolve the issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-1000356

GHSA-85WQ-PQHP-HMQ6

Produtos afetados

Jenkins

Referências · 9

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/23f4809e6c10a221e9d67f2e841536845387b42d · Nota
• https://github.com/jenkinsci/jenkins/commit/3c5e5ca63d9a1ac1c4087682dc0d426625eafed8 · Nota
• https://github.com/jenkinsci/jenkins/commit/e69c28e44dae41322112471e1c80f840bde314d4 · Nota
• https://jenkins.io/security/advisory/2017-04-26 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-85wq-pqhp-hmq6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000356 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1000356 · Aviso do Fabricante
• http://securityfocus.com/bid/98062 · Nota