The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade nodejs-optimistUpgrade nodejs-error-exUpgrade nodejs-chokidarUpgrade nodejs-end-of-streamUpgrade nodejs-lodash.basecopyUpgrade nodejs-align-textUpgrade nodejs-is-npmUpgrade nodejs-for-ownUpgrade openshift-origin-cartridge-perlUpgrade nodejs-array-uniqueUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-lodash.isargumentsUpgrade nodejs-is-streamUpgrade openshift-origin-cartridge-nodejsUpgrade nodejs-prepend-httpUpgrade nodejs-touchUpgrade nodejs-micromatchUpgrade nodejs-stream-combinerUpgrade nodejs-ansi-wrapUpgrade nodejs-duplexifyUpgrade nodejs-capture-stack-traceUpgrade nodejs-semver-diffUpgrade nodejs-uuidUpgrade nodejs-arr-flattenUpgrade nodejs-anymatchUpgrade nodejs-fill-rangeUpgrade nodejs-is-plain-objUpgrade nodejs-lodash.isarrayUpgrade nodejs-slideUpgrade nodejs-randomaticUpgrade nodejs-lazy-cacheUpgrade nodejs-binary-extensionsUpgrade openshift-origin-cartridge-phpUpgrade nodejs-is-globUpgrade nodejs-for-inUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-parse-globUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-success-symbolUpgrade nodejs-ps-treeUpgrade nodejs-lodash.restparamUpgrade nodejs-lodash.keysUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-os-tmpdirUpgrade nodejs-update-notifierUpgrade nodejs-string-lengthUpgrade nodejs-lowercase-keysUpgrade nodejs-pinkie-promiseUpgrade openshift-origin-cartridge-jenkinsUpgrade nodejs-os-homedirUpgrade nodejs-normalize-pathUpgrade nodejs-is-numberUpgrade nodejs-is-binary-pathUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade nodejs-node-status-codesUpgrade openshift-origin-node-utilUpgrade nodejs-duplexerUpgrade openshift-origin-brokerUpgrade nodejs-fromUpgrade nodejs-gotUpgrade nodejs-glob-parentUpgrade nodejs-lodash.baseassignUpgrade nodejs-nodemonUpgrade nodejs-isobjectUpgrade nodejs-event-streamUpgrade rubygem-openshift-origin-consoleUpgrade openshift-origin-broker-utilUpgrade nodejs-throughUpgrade nodejs-bracesUpgrade nodejs-expand-bracketsUpgrade heapsterUpgrade nodejs-registry-urlUpgrade nodejs-unzip-responseUpgrade nodejs-xdg-basedirUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-lodash.assignUpgrade openshift-origin-cartridge-jbosseapUpgrade rhcUpgrade nodejs-ansi-greenUpgrade nodejs-expand-rangeUpgrade nodejs-arr-diffUpgrade nodejs-semverUpgrade nodejs-kind-ofUpgrade nodejs-read-all-streamUpgrade openshift-origin-cartridge-jbossewsUpgrade openshift-origin-logshifterUpgrade rubygem-openshift-origin-gear-placementUpgrade openshift-ansibleUpgrade nodejs-latest-versionUpgrade nodejs-osenvUpgrade openvswitchUpgrade nodejs-timed-outUpgrade nodejs-rcUpgrade nodejs-strip-json-commentsUpgrade nodejs-repeat-elementUpgrade nodejs-configstoreUpgrade nodejs-mkdirpUpgrade nodejs-glob-baseUpgrade openshift-origin-cartridge-rubyUpgrade nodejs-is-extglobUpgrade nodejs-lodash.getnativeUpgrade nodejs-iniUpgrade nodejs-lodash.createassignerUpgrade nodejs-is-extendableUpgrade nodejs-object-assignUpgrade nodejs-arrifyUpgrade openshift-origin-cartridge-mockUpgrade nss_wrapperUpgrade nodejs-async-eachUpgrade nodejs-is-equal-shallowUpgrade rubygem-openshift-origin-routing-daemonUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-package-jsonUpgrade nodejs-splitUpgrade nodejs-extglobUpgrade nodejs-graceful-fsUpgrade openshift-origin-cartridge-diyUpgrade origin-kibanaUpgrade nodejs-parse-jsonUpgrade jenkinsUpgrade nodejs-pinkieUpgrade nodejs-is-dotfileUpgrade nodejs-pause-streamUpgrade nodejs-filename-regexUpgrade nodejs-undefsafeUpgrade nodejs-lodash.defaultsUpgrade nodejs-deep-extendUpgrade nodejs-url-parse-laxUpgrade nodejs-is-redirectUpgrade nodejs-readdirpUpgrade nodejs-regex-cacheUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-is-primitiveUpgrade nodejs-create-error-classUpgrade atomic-openshiftUpgrade nodejs-es6-promiseUpgrade nodejs-write-file-atomicUpgrade nodejs-map-streamUpgrade nodejs-preserveUpgrade nodejs-object.omit | Jun 18, 2018 | Feb 27, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub