PT-2015-6856 · Cloudbees+1 · Jenkins

Oleg Nenashev · Published 2015-11-25 · Updated 2022-05-13 · CVE-2015-5323

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.638 Jenkins LTS versions prior to 1.625.2

Description The issue allows remote administrators to potentially gain privileges and run scripts by using an API token of another user, due to improper access restrictions to API tokens.

Recommendations For Jenkins versions prior to 1.638, update to version 1.638 or later. For Jenkins LTS versions prior to 1.625.2, update to version 1.625.2 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-264

CWE-522

Related Identifiers

CVE-2015-5323

GHSA-X4M5-J4X4-4WJG

RHSA-2016:0070

RHSA-2016:0489

Affected Products

Jenkins

References · 7

• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:0070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5323 · Security Note
• https://osv.dev/vulnerability/GHSA-x4m5-j4x4-4wjg · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-0489.html · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/b3f16489ad5f15c3e749ed066cf6b4251f6668c6 · Note