CVEvulnerability
CVE-2015-5323
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-11-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Affected configurations
• redhat openshift (<= 3.1)
• redhat openshift 2.0
• jenkins jenkins (<= 1.625.1)
• jenkins jenkins (<= 1.637)
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2016-0489.html rhn.redhat.com
- https://access.redhat.com/errata/RHSA-2016:0070 access.redhat.com
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0489.html rhn.redhat.com
- https://access.redhat.com/errata/RHSA-2016:0070 access.redhat.com
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 Vendor Advisory