PT-2019-8738 · Cloudbees+1 · Jenkins

Publicado 2019-01-23 · Atualizado 2022-05-14 · CVE-2018-1000997

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.145 and earlier Jenkins LTS versions 2.138.1 and earlier

Description A path traversal issue exists in the Stapler web framework used by Jenkins, specifically in files such as Facet.java, GroovyFacet.java, JellyFacet.java, JRubyFacet.java, and JSPFacet.java. This allows attackers to render routable objects using any view in Jenkins, potentially exposing internal information about those objects that was not intended to be viewed, such as their toString() representation.

Recommendations For Jenkins versions 2.145 and earlier, update to a version later than 2.145 to resolve the issue. For Jenkins LTS versions 2.138.1 and earlier, update to a version later than 2.138.1 to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-1000997

GHSA-5HFP-964W-5VGM

Produtos afetados

Jenkins

Referências · 7

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/fd5f5be0304c6bf1918892b81e2efb6b6d09c521 · Nota
• https://github.com/jenkinsci/stapler/commit/0dfc28aa2102a59638484fc11c4c53b1dbb2baf0 · Nota
• https://osv.dev/vulnerability/GHSA-5hfp-964w-5vgm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000997 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-10-10/#SECURITY-867 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000997 · Nota de Segurança