GHSA-x4m5-j4x4-4wjg
Jenkins allows Administrators to Access API Tokens
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2015-5323
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Description
Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 1.625.2 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 1.626, fixed 1.638 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2015-5323 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/b3f16489ad5f15c3e749ed066cf6b4251f6668c6 WEB
- https://access.redhat.com/errata/RHSA-2016:0070 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 WEB
- http://rhn.redhat.com/errata/RHSA-2016-0489.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |