RETIRED: Jenkins Cross-Site Scripting, Security Bypass, and Denial of Service Vulnerabilities
BID:57994
Info
RETIRED: Jenkins Cross-Site Scripting, Security Bypass, and Denial of Service Vulnerabilities
| Bugtraq ID: | 57994 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 17 2013 12:00AM |
| Updated: | Mar 19 2015 08:27AM |
| Credit: | Reported by the vendor |
| Vulnerable: |
Redhat OpenShift Enterprise 0 Jenkins-Ci Jenkins 1.480.2 Jenkins-Ci Jenkins 1.480.1 Jenkins-Ci Jenkins 1.497 Jenkins-Ci Jenkins 1.491 Jenkins-Ci Jenkins 1.482 |
| Not Vulnerable: |
Jenkins-Ci Jenkins 1.480.3 Jenkins-Ci Jenkins 1.502 |
Discussion
RETIRED: Jenkins Cross-Site Scripting, Security Bypass, and Denial of Service Vulnerabilities
Jenkins is prone to the following security vulnerabilities:
1. An unspecified cross-site scripting vulnerability
2. An unspecified security-bypass vulnerability
3. An unspecified denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials or bypass security restrictions to perform unauthorized actions; this may aid to launch other attacks.
Versions prior to Jenkins 1.480.3 and 1.502 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
58726 Jenkins CVE-2013-0328 Unspecified Cross Site Scripting Vulnerability
58722 Jenkins CVE-2013-0330 Security Bypass Vulnerability
58721 Jenkins CVE-2013-0331 Denial Of Service Vulnerability
Jenkins is prone to the following security vulnerabilities:
1. An unspecified cross-site scripting vulnerability
2. An unspecified security-bypass vulnerability
3. An unspecified denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials or bypass security restrictions to perform unauthorized actions; this may aid to launch other attacks.
Versions prior to Jenkins 1.480.3 and 1.502 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
58726 Jenkins CVE-2013-0328 Unspecified Cross Site Scripting Vulnerability
58722 Jenkins CVE-2013-0330 Security Bypass Vulnerability
58721 Jenkins CVE-2013-0331 Denial Of Service Vulnerability
Exploit / POC
RETIRED: Jenkins Cross-Site Scripting, Security Bypass, and Denial of Service Vulnerabilities
To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
RETIRED: Jenkins Cross-Site Scripting, Security Bypass, and Denial of Service Vulnerabilities
Solution:
Updates are available. Please see the reference for more details.
Solution:
Updates are available. Please see the reference for more details.
References
RETIRED: Jenkins Cross-Site Scripting, Security Bypass, and Denial of Service Vulnerabilities
References:
References:
- Jenkins CI Homepage (Jenkins CI)
- Jenkins Security Advisory 2013-02-16 (Jenkins CI)
- Moderate: Red Hat OpenShift Enterprise 1.1.2 update (Red Hat)