Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation
The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-1810US | medium4.6 | — | ||
The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting,… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://rhn.redhat.com/errata/RHSA-2015-1844.htmlWEB
- https://access.redhat.com/errata/RHSA-2016:0070WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1205627WEB
- https://github.com/jenkinsci/jenkinsPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2015-1810ADVISORY
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan