CVEvulnerability
CVE-2015-1810
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-10-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:N/AC:H/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
Affected configurations
• jenkins jenkins (<= 1.580.3)
• redhat openshift (<= 3.1)
• jenkins jenkins (<= 1.599)
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2015-1844.html rhn.redhat.com
- https://access.redhat.com/errata/RHSA-2016:0070 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1205627 bugzilla.redhat.com
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1844.html rhn.redhat.com
- https://access.redhat.com/errata/RHSA-2016:0070 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1205627 bugzilla.redhat.com
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 Vendor Advisory