CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10353 – jenkins: CSRF protection tokens did not expire (SECURITY-626)
https://notcve.org/view.php?id=CVE-2019-10353
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection. Unos tokens de tipo CSRF en Jenkins versiones 2.185 y anteriores, LTS versiones 2.176.1 y anteriores, no expiraron, de este modo permitieron a atacantes capaces de lograrlo omitir la protección de tipo CSRF. A flaw was found in Jenkins in weekly versions prior to 2.186 and LTS versions prior to 2.176.2. By default, CSRF tokens in Jenkins only checked user authentication and IP address which allowed attackers able to obtain a CSRF token for another user. This allowed an attacker to implement CSRF attacks as long as the victim’s IP address remained unchanged. • http://www.openwall.com/lists/oss-security/2019/07/17/2 http://www.securityfocus.com/bid/109373 https://access.redhat.com/errata/RHSA-2019:2503 https://access.redhat.com/errata/RHSA-2019:2548 https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626 https://access.redhat.com/security/cve/CVE-2019-10353 https://bugzilla.redhat.com/show_bug.cgi?id=1730877 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-10354 – jenkins: Unauthorized view fragment access (SECURITY-534)
https://notcve.org/view.php?id=CVE-2019-10354
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information. Una vulnerabilidad en el framework web Stapler usado en Jenkins versiones 2.185 y anteriores, LTS versiones 2.176.1 y anteriores, ha permitido a los atacantes acceder directamente a los fragmentos de visualización, omitiendo las comprobaciones de permisos y posiblemente obtener información confidencial. • http://www.openwall.com/lists/oss-security/2019/07/17/2 http://www.securityfocus.com/bid/109373 https://access.redhat.com/errata/RHSA-2019:2503 https://access.redhat.com/errata/RHSA-2019:2548 https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534 https://access.redhat.com/security/cve/CVE-2019-10354 https://bugzilla.redhat.com/show_bug.cgi?id=1730869 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1003050
https://notcve.org/view.php?id=CVE-2019-1003050
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names. El control de formulario f: validateButton para la interfaz de usuario de Jenkins no escapa apropiadamente de las URL de tareas en Jenkins versión 2.171 y anteriores y Jenkins LTS versión 2.164.1 y anteriores, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) explotable por los usuarios con la capacidad de controlar los nombre de tarea. • http://www.securityfocus.com/bid/107889 https://access.redhat.com/errata/RHBA-2019:1605 https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327 https://www.oracle.com/security-alerts/cpuapr2022.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1003049
https://notcve.org/view.php?id=CVE-2019-1003049
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches. Los usuarios que almacenaron su autenticación CLI antes de que Jenkins se actualizara a la versión 2.150.2 o posteriores, o a la versión 2.160 o posteriores, permanecerían autenticados en Jenkins 2.171 y anteriores y en Jenkins LTS 2.164.1 y anteriores, ya que la solución para CVE-2019-1003004 en estas versiones no rechazaba las cachés de autenticación CLI remotas existentes. • http://www.securityfocus.com/bid/107901 https://access.redhat.com/errata/RHBA-2019:1605 https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289 https://www.oracle.com/security-alerts/cpuapr2022.html • CWE-613: Insufficient Session Expiration •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1000997
https://notcve.org/view.php?id=CVE-2018-1000997
A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation. Existe una vulnerabilidad de salto de directorio en el framework web Stapler empleado por Jenkins, en versiones 2.145 y anteriores y versiones LTS 2.138.1 y anteriores, en core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java y jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java. Dicha vulnerabilidad permite que los atacantes rendericen objetos enrutables mediante cualquier vista de Jenkins, exponiendo la información interna sobre esos objetos que no deberían ser visibles, como su representación toString(). • https://jenkins.io/security/advisory/2018-10-10/#SECURITY-867 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •