PT-2015-5452 · Cloudbees+1 · Jenkins

Daniel Beck · Published 2015-10-16 · Updated 2022-05-17 · CVE-2015-1810

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.600 Jenkins LTS versions prior to 1.596.1

Description The issue allows remote attackers to gain privileges by creating a reserved name, due to the HudsonPrivateSecurityRealm class not restricting access to reserved names when using the "Jenkins' own user database" setting.

Recommendations For versions prior to 1.600, update to version 1.600 or later. For LTS versions prior to 1.596.1, update to version 1.596.1 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-264

CWE-287

Related Identifiers

CVE-2015-1810

GHSA-37WM-28RM-56VW

RHSA-2015:1844

RHSA-2016:0070

Affected Products

Jenkins

References · 7

• https://osv.dev/vulnerability/GHSA-37wm-28rm-56vw · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1844.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:0070 · Vendor Advisory
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1810 · Security Note
• https://github.com/jenkinsci/jenkins · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1205627 · Note