Описание
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Отчет
This vulnerability is only exploitable by a user with developer permissions. Therefore this vulnerability is rated Important for OpenShift Container Platform 3.x.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.2 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.3 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.4 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.5 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.6 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.7 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.9 | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.11 | jenkins | Fixed | RHBA-2019:0024 | 10.01.2019 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
A code execution vulnerability exists in the Stapler web framework use ...
Уязвимость функции в stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java компонента Stapler сервера автоматизации Jenkins, позволяющая нарушителю выполнить произвольный код
EPSS
8.8 High
CVSS3