DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Jenkins: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2015-11-11
Ein entfernter, anonymer oder angemeldeter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsfunktionen zu umgehen, einen "stored cross-site-scripting"-Angriff durchzuführen, Benutzerrechte zu erlangen und um Informationen offenzulegen.
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-8103US | critical9.8 | Exploit | ||
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a proble… | ||||
| CVE-2015-5326US | medium4.3 | — | ||
Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inj… | ||||
| CVE-2015-5325US | high7.5 | — | ||
Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists becau… | ||||
| CVE-2015-5324US | medium5.0 | — | ||
Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api. | ||||
| CVE-2015-5323US | medium6.5 | — | ||
Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API… | ||||
| CVE-2015-5322US | medium5.0 | — | ||
Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet… | ||||
| CVE-2015-5321US | medium5.0 | — | ||
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct… | ||||
| CVE-2015-5320US | medium5.0 | — | ||
Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain s… | ||||
| CVE-2015-5319US | medium5.0 | — | ||
XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted j… | ||||
| CVE-2015-5318US | medium6.8 | — | ||
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protec… | ||||
| CVE-2015-5317US | medium5.0OT kritisch | KEV | ||
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2016:0070 vom 2016-01-27external
- RedHat Security Advisory RHSA-2016-0489external
- WID-SEC-W-2023-1215 - CSAF Versionself
- WID-SEC-2023-1215 - Portal Versionself
- Jenkins Security Advisory vom 2015-11-11external
- CISA Known Exploited Vulnerabilities Catalog vom 2023-05-14external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan