The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
CVSS Details
- CVSS 3.1 Base Score: 5.6
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade nodejs-map-streamUpgrade nodejs-is-binary-pathUpgrade nodejs-pinkie-promiseUpgrade nodejs-is-streamUpgrade nodejs-lodash.isiterateecallUpgrade openshift-origin-cartridge-perlUpgrade nodejs-lodash.assignUpgrade nodejs-fromUpgrade nodejs-normalize-pathUpgrade nodejs-lodash.keysUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-update-notifierUpgrade nodejs-configstoreUpgrade nodejs-duplexifyUpgrade nodejs-ansi-greenUpgrade nodejs-lowercase-keysUpgrade nodejs-semverUpgrade openshift-origin-cartridge-rubyUpgrade nodejs-url-parse-laxUpgrade nodejs-end-of-streamUpgrade origin-kibanaUpgrade openshift-origin-cartridge-diyUpgrade nodejs-extglobUpgrade rubygem-openshift-origin-controllerUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade heapsterUpgrade nodejs-lodash.createassignerUpgrade nodejs-strip-json-commentsUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-iniUpgrade nodejs-arr-diffUpgrade openshift-ansibleUpgrade nodejs-arrifyUpgrade nodejs-string-lengthUpgrade nodejs-graceful-fsUpgrade nodejs-pause-streamUpgrade nodejs-is-primitiveUpgrade nodejs-expand-bracketsUpgrade nodejs-mkdirpUpgrade openshift-origin-cartridge-jbosseapUpgrade nodejs-rcUpgrade nodejs-write-file-atomicUpgrade nodejs-lodash.defaultsUpgrade nodejs-bracesUpgrade nodejs-repeat-elementUpgrade rubygem-openshift-origin-routing-daemonUpgrade nss_wrapperUpgrade jenkinsUpgrade nodejs-readdirpUpgrade nodejs-pinkieUpgrade nodejs-lazy-cacheUpgrade nodejs-read-all-streamUpgrade nodejs-nodemonUpgrade openshift-origin-cartridge-mockUpgrade nodejs-for-ownUpgrade nodejs-micromatchUpgrade nodejs-lodash.getnativeUpgrade nodejs-regex-cacheUpgrade nodejs-glob-parentUpgrade nodejs-is-numberUpgrade openshift-origin-broker-utilUpgrade nodejs-gotUpgrade nodejs-object.omitUpgrade nodejs-is-redirectUpgrade nodejs-undefsafeUpgrade nodejs-anymatchUpgrade nodejs-slideUpgrade rubygem-openshift-origin-gear-placementUpgrade nodejs-is-extendableUpgrade nodejs-is-dotfileUpgrade nodejs-filename-regexUpgrade nodejs-os-homedirUpgrade nodejs-parse-jsonUpgrade nodejs-uuidUpgrade nodejs-stream-combinerUpgrade nodejs-event-streamUpgrade nodejs-semver-diffUpgrade openshift-origin-cartridge-phpUpgrade nodejs-ps-treeUpgrade atomic-openshiftUpgrade nodejs-glob-baseUpgrade nodejs-object-assignUpgrade nodejs-throughUpgrade nodejs-async-eachUpgrade nodejs-es6-promiseUpgrade openshift-origin-brokerUpgrade openshift-origin-cartridge-nodejsUpgrade nodejs-success-symbolUpgrade nodejs-for-inUpgrade nodejs-expand-rangeUpgrade nodejs-is-npmUpgrade nodejs-lodash.basecopyUpgrade nodejs-osenvUpgrade openshift-origin-logshifterUpgrade nodejs-duplexerUpgrade nodejs-os-tmpdirUpgrade nodejs-touchUpgrade nodejs-ansi-wrapUpgrade nodejs-array-uniqueUpgrade nodejs-isobjectUpgrade openshift-origin-cartridge-jenkinsUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-prepend-httpUpgrade nodejs-latest-versionUpgrade nodejs-fill-rangeUpgrade openvswitchUpgrade nodejs-chokidarUpgrade nodejs-timed-outUpgrade nodejs-lodash.restparamUpgrade nodejs-align-textUpgrade openshift-origin-cartridge-jbossewsUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-deep-extendUpgrade nodejs-is-plain-objUpgrade nodejs-is-extglobUpgrade nodejs-kind-ofUpgrade nodejs-lodash.isarrayUpgrade openshift-origin-node-utilUpgrade nodejs-arr-flattenUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-package-jsonUpgrade nodejs-capture-stack-traceUpgrade nodejs-xdg-basedirUpgrade nodejs-registry-urlUpgrade nodejs-randomaticUpgrade nodejs-is-equal-shallowUpgrade nodejs-parse-globUpgrade nodejs-binary-extensionsUpgrade nodejs-splitUpgrade nodejs-error-exUpgrade nodejs-lodash.baseassignUpgrade nodejs-preserveUpgrade nodejs-lodash.isargumentsUpgrade nodejs-optimistUpgrade rhcUpgrade nodejs-create-error-classUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-is-globUpgrade nodejs-node-status-codesUpgrade nodejs-unzip-response | Jun 18, 2018 | Feb 27, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub