Jenkins Unspecified Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
BID:55585
Info
Jenkins Unspecified Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
| Bugtraq ID: | 55585 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 17 2012 12:00AM |
| Updated: | Sep 17 2012 12:00AM |
| Credit: | Avram Marius Gabriel |
| Vulnerable: |
Jenkins-Ci Jenkins 1.409.3 Jenkins-Ci Jenkins 1.454 Jenkins-Ci Jenkins 1.452 Jenkins-Ci Jenkins 1.451 Jenkins-Ci Jenkins 1.447 Jenkins-Ci Jenkins 1.446 Jenkins-Ci Jenkins 1.438 Jenkins-Ci Jenkins 1.424.5.1 Jenkins-Ci Jenkins 1.424.5 Jenkins-Ci Jenkins 1.424.3 Jenkins-Ci Jenkins 1.424.2 Jenkins-Ci Jenkins 1.424.1 |
| Not Vulnerable: |
Jenkins-Ci Jenkins Enterprise 1.466.2.1 Jenkins-Ci Jenkins Enterprise 1.447.3.1 Jenkins-Ci Jenkins Enterprise 1.424.6.11 Jenkins-Ci Jenkins 1.482 Jenkins-Ci Jenkins 1.466.2 LTS |
Discussion
Jenkins Unspecified Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
Jenkins is prone to an unspecified cross-site-scripting vulnerability and an unspecified arbitrary code-execution vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can exploit these issues to execute arbitrary code in the context of the web server, compromise the affected application, and steal cookie-based authentication credentials from legitimate users of the site. Other attacks are also possible.
Jenkins versions prior to 1.482 and 1.466.2 LTS are vulnerable.
Jenkins is prone to an unspecified cross-site-scripting vulnerability and an unspecified arbitrary code-execution vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can exploit these issues to execute arbitrary code in the context of the web server, compromise the affected application, and steal cookie-based authentication credentials from legitimate users of the site. Other attacks are also possible.
Jenkins versions prior to 1.482 and 1.466.2 LTS are vulnerable.
Exploit / POC
Jenkins Unspecified Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
Attackers can exploit these issues with a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues with a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.