Current Description
The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
Source:
MITRE
Description Last Modified:
06/10/2016
View Analysis Description
Analysis Description
The combination filter Groovy script in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
Source:
MITRE
Description Last Modified:
10/16/2015
Impact
CVSS v2.0 Severity and Metrics:
Base Score:
6.5 MEDIUM
Vector:
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
(V2 legend)
Impact Subscore:
6.4
Exploitability Subscore:
8.0
Access Vector (AV):
Network
Access Complexity (AC):
Low
Authentication (AU):
Single
Confidentiality (C):
Partial
Integrity (I):
Partial
Availability (A):
Partial
Additional Information:
Allows unauthorized disclosure of information
Allows unauthorized modification
Allows disruption of service
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because
they may have information that would be of interest to you. No inferences should be drawn on account of other sites
being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose.
NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further,
NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about
this page to nvd@nist.gov.
Technical Details
Vulnerability Type
(View All)
- Permissions, Privileges, and Access Control (CWE-264)
Change History
7 change records found
- show changes
Modified Analysis -
6/15/2016 12:48:44 PM
| Action |
Type |
Old Value |
New Value |
| Changed |
CPE Configuration |
Configuration 1
OR
*cpe:2.3:a:cloudbees:jenkins:1.600:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:cloudbees:jenkins:1.580.3:*:*:*:lts:*:*:* (and previous)
Configuration 2
OR
*cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:* (and previous) |
Configuration 1
OR
*cpe:2.3:a:jenkins:jenkins:1.580.3:*:*:*:lts:*:*:* (and previous)
Configuration 2
OR
*cpe:2.3:a:jenkins:jenkins:1.599:*:*:*:*:*:*:* (and previous)
Configuration 3
OR
*cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:* (and previous) |
CVE Translated -
6/12/2016 12:45:04 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Translation |
|
La secuencia de comandos del filtro de combinación Groovy en Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados con permisos de configuración de trabajo obtener privilegios y ejecutar código arbitrario en el maestro a través de vectores no especificados. |
| Removed |
Translation |
La secuencia de comandos en el combination filter de Groovy en CloudBees Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados con permiso de configuración de trabajo obtener privilegios y ejecutar código arbitrario en el master a través de vectores no especificados. |
|
CVE Modified by Source -
6/10/2016 10:00:05 PM
| Action |
Type |
Old Value |
New Value |
| Changed |
Description |
The combination filter Groovy script in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors. |
The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors. |
Modified Analysis -
3/23/2016 2:35:05 PM
| Action |
Type |
Old Value |
New Value |
| Changed |
CPE Configuration |
Configuration 1
OR
*cpe:2.3:a:cloudbees:jenkins:1.600:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:cloudbees:jenkins:1.580.3:*:*:*:lts:*:*:* (and previous) |
Configuration 1
OR
*cpe:2.3:a:cloudbees:jenkins:1.600:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:cloudbees:jenkins:1.580.3:*:*:*:lts:*:*:* (and previous)
Configuration 2
OR
*cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:* (and previous) |
CVE Modified by Source -
2/4/2016 9:59:12 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
https://access.redhat.com/errata/RHSA-2016:0070 |
Modified Analysis -
10/19/2015 2:58:30 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CPE Configuration |
|
Configuration 1
OR
*cpe:2.3:a:cloudbees:jenkins:1.600:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:cloudbees:jenkins:1.580.3:*:*:*:lts:*:*:* (and previous) |
| Added |
CVSS V2 |
|
(AV:N/AC:L/Au:S/C:P/I:P/A:P) |
| Added |
CWE |
|
CWE-264 |
| Changed |
Reference Type |
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 No Types Assigned |
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 Advisory |
Initial CVE Analysis -
10/19/2015 11:49:05 AM