PT-2018-9585 · Cloudbees+1 · Jenkins

Evan Grant + 1 · Publicado 2018-12-10 · Atualizado 2022-05-13 · CVE-2018-1000863

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.153 and earlier Jenkins LTS versions 2.138.3 and earlier

Description A data modification issue exists that allows attackers to submit crafted user names, potentially causing an improper migration of user record storage formats. This could prevent the victim from logging into Jenkins. The issue is related to the User.java and IdStrategy.java files.

Recommendations For Jenkins versions 2.153 and earlier, update to a version that fixes the improper migration of user record storage formats. For Jenkins LTS versions 2.138.3 and earlier, update to a version that fixes the improper migration of user record storage formats.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-1000863

GHSA-4JHM-5F7G-75FP

Produtos afetados

Jenkins

Referências · 10

• 🔥 https://tenable.com/security/research/tra-2018-43 · Exploit
• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/7bae6dd6ef23af988801d38dc0f8f693bc6283f8 · Nota
• https://github.com/jenkinsci/jenkins/commit/4ed66e5838476e575a83c3cd13fffb37eefa2f48 · Nota
• https://access.redhat.com/errata/RHBA-2019:0024 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000863 · Nota de Segurança
• http://securityfocus.com/bid/106176 · Nota
• https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4jhm-5f7g-75fp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000863 · Aviso do Fabricante