GitHub Advisoryadvisory · Maven

GHSA-mm9c-4cv4-7rfv Jenkins allows for Privilege Escalation by Remote Authenticated Users

MEDIUM Published 2022-05-17 Modified 2025-03-13 Official page ↗
Aliases
CVE-2015-1806
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-266
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.597, < 1.600 → fixed in 1.600 • Maven org.jenkins-ci.main:jenkins-core: < 1.596.1 → fixed in 1.596.1

Description

The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2015-1806 The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job… vulnerability

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References