A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm that results in the creation of an ephemeral user record in memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2018 10 10 | — | Upgrade Jenkins LTS to version 2.138.2Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.146 | Jan 23, 2019 | Jan 9, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshiftUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-web-consoleUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-cluster-autoscalerUpgrade openshift-enterprise-autohealUpgrade kibanaUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-deschedulerUpgrade openshift-monitor-project-lifecycleUpgrade atomic-openshift-service-idlerUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-node_exporterUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-node-problem-detectorUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-dockerregistryUpgrade jenkinsUpgrade cri-oUpgrade atomic-openshift-metrics-serverUpgrade openshift-ansibleUpgrade openshift-monitor-sample-app | Apr 15, 2019 | Oct 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub