Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-w2hv-rcqr-2h7r

Опубликовано: 24 мая 2022
Источник: github
Github: Прошло ревью
CVSS3: 4.3

Описание

View name validation bypass in Jenkins

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name. When a form to create a view is submitted, the name is included twice in the submission. One instance is validated, but the other instance is used to create the value.

This allows attackers with View/Create permission to create views with invalid or already-used names.

Jenkins 2.287, LTS 2.277.2 uses the same submitted value for validation and view creation.

Пакеты

Наименование

org.jenkins-ci.main:jenkins-core

maven
Затронутые версииВерсия исправления

< 2.277.2

2.277.2

Наименование

org.jenkins-ci.main:jenkins-core

maven
Затронутые версииВерсия исправления

>= 2.278, <= 2.286

2.287

EPSS

Процентиль: 72%
0.00703
Низкий

4.3 Medium

CVSS3

Дефекты

CWE-240

Связанные уязвимости

CVSS3: 4.3
ubuntu
почти 5 лет назад

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

CVSS3: 4.3
redhat
почти 5 лет назад

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

CVSS3: 4.3
nvd
почти 5 лет назад

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

CVSS3: 4.3
debian
почти 5 лет назад

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly c ...

EPSS

Процентиль: 72%
0.00703
Низкий

4.3 Medium

CVSS3

Дефекты

CWE-240