GitHub Advisoryadvisory · Maven

GHSA-3269-jqp5-v8c9 Jenkins allows for Privilege Escalation by Remote Authenticated Users

MEDIUM Published 2022-05-17 Modified 2025-03-13 Official page ↗
Aliases
CVE-2015-1814
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-266
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.597, < 1.606 → fixed in 1.606 • Maven org.jenkins-ci.main:jenkins-core: < 1.596.2 → fixed in 1.596.2

Description

The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.

Related

Alias · CVE (1)

  • CVE-2015-1814 The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API… vulnerability

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References