CVE-2015-1810

EPSS 0.43%
Published 16.10.2015 20:59:08
Last modified 12.04.2025 10:46:40
Source secalert@redhat.com
Teams watchlist Login
Open Login

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

Affected products Warnungen 0 Metrics 2 CWE 0 References 7

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Jenkins SwEditionlts Version <= 1.580.3

Redhat ≫ Openshift SwEditionenterprise Version <= 3.1

Jenkins ≫ Jenkins Version <= 1.599

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.43%	0.621

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.6	3.9	6.4	AV:N/AC:H/Au:S/C:P/I:P/A:P

https://access.redhat.com/errata/RHSA-2016:0070

http://rhn.redhat.com/errata/RHSA-2015-1844.html

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1205627

https://nvd.nist.gov/vuln/detail/CVE-2015-1810

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-1810

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-1810

EUVD