Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins to version 1.638Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 1.625.2 | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-es6-promiseUpgrade nodejs-undefsafeUpgrade nodejs-is-redirectUpgrade nodejs-arr-diffUpgrade nodejs-end-of-streamUpgrade nodejs-fromUpgrade nodejs-is-streamUpgrade nodejs-ansi-wrapUpgrade jenkinsUpgrade nodejs-arrifyUpgrade nodejs-object-assignUpgrade nodejs-repeat-elementUpgrade nodejs-lodash.isarrayUpgrade nss_wrapperUpgrade rubygem-openshift-origin-nodeUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-lodash.createassignerUpgrade nodejs-regex-cacheUpgrade nodejs-readdirpUpgrade openvswitchUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-pause-streamUpgrade openshift-origin-cartridge-cronUpgrade openshift-ansibleUpgrade nodejs-lodash.assignUpgrade rubygem-openshift-origin-commonUpgrade nodejs-uuidUpgrade phpUpgrade nodejs-mkdirpUpgrade nodejs-is-extendableUpgrade nodejs-duplexifyUpgrade nodejs-lodash.keysUpgrade nodejs-lodash.defaultsUpgrade nodejs-micromatchUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-pinkieUpgrade nodejs-configstoreUpgrade nodejs-preserveUpgrade nodejs-extglobUpgrade nodejs-filename-regexUpgrade nodejs-lodash.getnativeUpgrade nodejs-read-all-streamUpgrade nodejs-strip-json-commentsUpgrade openshift-origin-cartridge-mysqlUpgrade openshift-enterprise-upgradeUpgrade rhcUpgrade nodejs-package-jsonUpgrade nodejs-latest-versionUpgrade nodejs-write-file-atomicUpgrade nodejs-deep-extendUpgrade nodejs-lodash.restparamUpgrade nodejs-url-parse-laxUpgrade nodejs-osenvUpgrade nodejs-string-lengthUpgrade nodejs-kind-ofUpgrade nodejs-async-eachUpgrade nodejs-is-dotfileUpgrade nodejs-expand-bracketsUpgrade nodejs-fill-rangeUpgrade origin-kibanaUpgrade nodejs-rcUpgrade nodejs-semverUpgrade nodejs-glob-parentUpgrade nodejs-graceful-fsUpgrade nodejs-iniUpgrade nodejs-map-streamUpgrade nodejs-bracesUpgrade nodejs-timed-outUpgrade openshift-origin-node-proxyUpgrade nodejs-normalize-pathUpgrade nodejs-is-primitiveUpgrade nodejs-registry-urlUpgrade nodejs-lodash.baseassignUpgrade openshift-origin-cartridge-phpUpgrade nodejs-os-tmpdirUpgrade nodejs-ps-treeUpgrade nodejs-success-symbolUpgrade nodejs-is-numberUpgrade nodejs-glob-baseUpgrade nodejs-os-homedirUpgrade nodejs-stream-combinerUpgrade nodejs-array-uniqueUpgrade nodejs-splitUpgrade nodejs-error-exUpgrade nodejs-align-textUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-is-equal-shallowUpgrade nodejs-node-status-codesUpgrade nodejs-parse-globUpgrade nodejs-slideUpgrade openshift-origin-node-utilUpgrade nodejs-create-error-classUpgrade nodejs-lodash.basecopyUpgrade nodejs-lowercase-keysUpgrade nodejs-xdg-basedirUpgrade nodejs-unzip-responseUpgrade nodejs-expand-rangeUpgrade heapsterUpgrade nodejs-randomaticUpgrade nodejs-is-binary-pathUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-arr-flattenUpgrade nodejs-is-plain-objUpgrade nodejs-pinkie-promiseUpgrade nodejs-for-inUpgrade nodejs-parse-jsonUpgrade nodejs-ansi-greenUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-lodash.isiterateecallUpgrade activemqUpgrade nodejs-object.omitUpgrade atomic-openshiftUpgrade nodejs-prepend-httpUpgrade nodejs-throughUpgrade nodejs-is-extglobUpgrade nodejs-semver-diffUpgrade nodejs-anymatchUpgrade nodejs-lodash.isargumentsUpgrade nodejs-duplexerUpgrade nodejs-chokidarUpgrade nodejs-lazy-cacheUpgrade openshift-origin-broker-utilUpgrade nodejs-update-notifierUpgrade nodejs-event-streamUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-binary-extensionsUpgrade nodejs-isobjectUpgrade nodejs-touchUpgrade nodejs-is-globUpgrade nodejs-nodemonUpgrade nodejs-optimistUpgrade nodejs-for-ownUpgrade nodejs-capture-stack-traceUpgrade nodejs-gotUpgrade nodejs-is-npm | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub