PT-2013-1872 · Cloudbees+1 · Jenkins

Soroush Dalili · Published 2013-02-24 · Updated 2022-05-14 · CVE-2012-6073

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.491 Jenkins LTS versions prior to 1.480.1 Jenkins Enterprise versions 1.424.x prior to 1.424.6.13 Jenkins Enterprise versions 1.447.x prior to 1.447.4.1 Jenkins Enterprise versions 1.466.x prior to 1.466.10.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.

Recommendations For Jenkins versions prior to 1.491, update to version 1.491 or later. For Jenkins LTS versions prior to 1.480.1, update to version 1.480.1 or later. For Jenkins Enterprise versions 1.424.x prior to 1.424.6.13, update to version 1.424.6.13 or later. For Jenkins Enterprise versions 1.447.x prior to 1.447.4.1, update to version 1.447.4.1 or later. For Jenkins Enterprise versions 1.466.x prior to 1.466.10.1, update to version 1.466.10.1 or later.

Fix

Open Redirect

RCE

Weakness Enumeration

CWE-601

CWE-20

Related Identifiers

CVE-2012-6073

GHSA-MQGF-4RW4-2CQ2

RHSA-2013:0220

Affected Products

Jenkins

References · 8

• http://cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6073 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0220.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mqgf-4rw4-2cq2 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=890608 · Note
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20 · Note
• http://openwall.com/lists/oss-security/2012/12/28/1 · Note