Описание
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
8.8 High
CVSS3
Дефекты
Связанные уязвимости
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.42 ...
Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
Уязвимость встроенного интерфейса командной строки (CLI) сервера автоматизации Jenkins, позволяющая нарушителю реализовать CSWSH-атаку
EPSS
8.8 High
CVSS3