CVE-2013-2034
At a glance
- Source
- NVD
- EPSS
- EPSS 1.62 % · percentile 76 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.
Weaknesses (CWE)
- CWE-352 — Cross-Site Request Forgery
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-fg4r-f9j2-36mw — Jenkins Cross-Site Request Forgery vulnerabilities
European references
- ENISA EUVD · EUVD-2022-3770
- GCVE · GCVE-0-2013-2034
Affected configurations (NVD CPE)
cpe:2.3:a:cloudbees:jenkins:*:*:*:*:*:*:*:*≤ 1.513cpe:2.3:a:cloudbees:jenkins:1.466:*:*:*:enterprise:*:*:*cpe:2.3:a:cloudbees:jenkins:1.480:*:*:*:enterprise:*:*:*cpe:2.3:a:cloudbees:jenkins:1.509:*:*:*:lts:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |