4.6

CVE-2015-1810

EPSS 0.43%
Veröffentlicht 16.10.2015 20:59:08
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Jenkins SwEditionlts Version <= 1.580.3

Redhat ≫ Openshift SwEditionenterprise Version <= 3.1

Jenkins ≫ Jenkins Version <= 1.599

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.43%	0.62

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.6	3.9	6.4	AV:N/AC:H/Au:S/C:P/I:P/A:P

https://access.redhat.com/errata/RHSA-2016:0070

http://rhn.redhat.com/errata/RHSA-2015-1844.html

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1205627

https://nvd.nist.gov/vuln/detail/CVE-2015-1810

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-1810

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-1810

EUVD