The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 03 23 | — | Upgrade Jenkins LTS to version 1.596.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.606Upgrade Jenkins to the latest version | Nov 13, 2017 | Oct 16, 2015 |
| Redhat Openshift | — | Upgrade nodejs-pinkieUpgrade nodejs-glob-baseUpgrade nodejs-parse-jsonUpgrade nodejs-timed-outUpgrade openshift-origin-cartridge-jbossewsUpgrade nodejs-preserveUpgrade nodejs-mkdirpUpgrade nodejs-object.omitUpgrade nodejs-url-parse-laxUpgrade nodejs-pause-streamUpgrade nodejs-graceful-fsUpgrade nodejs-async-eachUpgrade nodejs-rcUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-equal-shallowUpgrade openshift-origin-cartridge-haproxyUpgrade openshift-origin-logshifterUpgrade nodejs-osenvUpgrade nss_wrapperUpgrade nodejs-filename-regexUpgrade openshift-origin-cartridge-mockUpgrade nodejs-is-extglobUpgrade nodejs-is-extendableUpgrade nodejs-chokidarUpgrade nodejs-semverUpgrade nodejs-lodash.assignUpgrade openshift-origin-cartridge-rubyUpgrade nodejs-write-file-atomicUpgrade rhcUpgrade nodejs-ansi-wrapUpgrade nodejs-undefsafeUpgrade atomic-openshiftUpgrade nodejs-is-dotfileUpgrade nodejs-read-all-streamUpgrade nodejs-create-error-classUpgrade nodejs-es6-promiseUpgrade origin-kibanaUpgrade nodejs-kind-ofUpgrade nodejs-latest-versionUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-configstoreUpgrade rubygem-openshift-origin-routing-daemonUpgrade nodejs-lodash.defaultsUpgrade nodejs-arr-diffUpgrade nodejs-lowercase-keysUpgrade openvswitchUpgrade nodejs-readdirpUpgrade nodejs-micromatchUpgrade nodejs-iniUpgrade nodejs-repeat-elementUpgrade nodejs-fill-rangeUpgrade nodejs-object-assignUpgrade openshift-ansibleUpgrade jenkinsUpgrade nodejs-lodash.createassignerUpgrade nodejs-arrifyUpgrade nodejs-is-redirectUpgrade nodejs-regex-cacheUpgrade openshift-origin-cartridge-jbosseapUpgrade openshift-origin-cartridge-diyUpgrade rubygem-openshift-origin-gear-placementUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade nodejs-package-jsonUpgrade nodejs-extglobUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-strip-json-commentsUpgrade nodejs-nodemonUpgrade nodejs-array-uniqueUpgrade nodejs-parse-globUpgrade nodejs-ps-treeUpgrade nodejs-xdg-basedirUpgrade nodejs-bracesUpgrade nodejs-touchUpgrade openshift-origin-cartridge-phpUpgrade nodejs-event-streamUpgrade nodejs-is-numberUpgrade nodejs-binary-extensionsUpgrade nodejs-lodash.baseassignUpgrade openshift-origin-cartridge-nodejsUpgrade nodejs-map-streamUpgrade openshift-origin-cartridge-perlUpgrade nodejs-throughUpgrade nodejs-optimistUpgrade openshift-origin-broker-utilUpgrade nodejs-update-notifierUpgrade nodejs-lodash.isargumentsUpgrade nodejs-unzip-responseUpgrade nodejs-expand-rangeUpgrade nodejs-isobjectUpgrade nodejs-is-plain-objUpgrade nodejs-gotUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-uuidUpgrade nodejs-splitUpgrade nodejs-duplexerUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-os-homedirUpgrade nodejs-deep-extendUpgrade nodejs-end-of-streamUpgrade nodejs-lodash.basecopyUpgrade nodejs-for-ownUpgrade nodejs-is-binary-pathUpgrade nodejs-duplexifyUpgrade nodejs-os-tmpdirUpgrade nodejs-lodash.isarrayUpgrade nodejs-error-exUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-is-globUpgrade nodejs-is-streamUpgrade nodejs-lazy-cacheUpgrade nodejs-stream-combinerUpgrade nodejs-lodash.keysUpgrade openshift-origin-brokerUpgrade nodejs-expand-bracketsUpgrade nodejs-normalize-pathUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-string-lengthUpgrade nodejs-anymatchUpgrade nodejs-success-symbolUpgrade nodejs-is-npmUpgrade nodejs-ansi-greenUpgrade nodejs-randomaticUpgrade openshift-origin-node-utilUpgrade nodejs-prepend-httpUpgrade nodejs-for-inUpgrade openshift-origin-cartridge-jenkinsUpgrade nodejs-arr-flattenUpgrade nodejs-align-textUpgrade nodejs-lodash.restparamUpgrade nodejs-is-primitiveUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade heapsterUpgrade nodejs-pinkie-promiseUpgrade nodejs-slideUpgrade nodejs-fromUpgrade nodejs-registry-urlUpgrade nodejs-node-status-codesUpgrade nodejs-capture-stack-traceUpgrade nodejs-glob-parentUpgrade nodejs-semver-diff | Jun 18, 2018 | Mar 23, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub