CVE-2018-1000862

Опубликовано: 10 дек. 2018

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.

Ссылки

http://www.securityfocus.com/bid/106176
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHBA-2019:0024
Third Party Advisory
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904
Vendor Advisory
http://www.securityfocus.com/bid/106176
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHBA-2019:0024
Third Party Advisory
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Версия до 2.138.3 (включая)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

Версия до 2.153 (включая)

Конфигурация 2

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.00184

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2018-1000862

CVSS3: 4.3

redhat

около 7 лет назад

CVE-2018-1000862

CVSS3: 4.3

debian

около 7 лет назад

An information exposure vulnerability exists in Jenkins 2.153 and earl ...

GHSA-hph9-9vcq-f7gp

CVSS3: 4.3

github

больше 3 лет назад

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

EPSS

Процентиль: 40%

0.00184

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200