CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-5325 – jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)
https://notcve.org/view.php?id=CVE-2015-5325
Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665. Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 permite a atacantes eludir las restricciones slave-to-master destinadas al acceso aprovechando un esclavo JNLP. NOTA: esta vulnerabilidad existe a causa de una solución incompleta para CVE-2014-3665. • http://rhn.redhat.com/errata/RHSA-2016-0489.html https://access.redhat.com/errata/RHSA-2016:0070 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 https://access.redhat.com/security/cve/CVE-2015-5325 https://bugzilla.redhat.com/show_bug.cgi?id=1282368 • CWE-284: Improper Access Control •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2015-5321 – jenkins: Information disclosure via sidepanel (SECURITY-192)
https://notcve.org/view.php?id=CVE-2015-5321
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages. Los widgets de panel lateral en el comando CLI de la páginas de resumen y ayuda en Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 permiten a atacantes remotos obtener información sensible a través de una petición directa a las páginas. • http://rhn.redhat.com/errata/RHSA-2016-0489.html https://access.redhat.com/errata/RHSA-2016:0070 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 https://access.redhat.com/security/cve/CVE-2015-5321 https://bugzilla.redhat.com/show_bug.cgi?id=1282364 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 2%CPEs: 2EXPL: 0CVE-2014-3665
https://notcve.org/view.php?id=CVE-2014-3665
Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave. Jenkins en versiones anteriores a 1.587 y LTS en versiones anteriores a 1.580.1 no asegura correctamente la separación de confianza entre un maestro y un esclavo, lo que podría permitir a atacantes remotos ejecutar código arbitrario en el maestro aprovechando el acceso al esclavo. • https://bugzilla.redhat.com/show_bug.cgi?id=1147767 https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 https://www.cloudbees.com/jenkins-security-advisory-2014-10-30 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2015-5320 – jenkins: Secret key not verified when connecting a slave (SECURITY-184)
https://notcve.org/view.php?id=CVE-2015-5320
Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave. Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 no verifica adecuadamente el secreto compartido utilizado en conexiones esclavo JNLP, lo que permite a atacantes remotos conectar como esclavos y obtener información sensible o posiblemente obtener acceso administrativo aprovechando el conocimiento del nombre de un esclavo. • http://rhn.redhat.com/errata/RHSA-2016-0489.html https://access.redhat.com/errata/RHSA-2016:0070 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 https://access.redhat.com/security/cve/CVE-2015-5320 https://bugzilla.redhat.com/show_bug.cgi?id=1282363 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2015-5318 – jenkins: Public value used for CSRF protection salt (SECURITY-169)
https://notcve.org/view.php?id=CVE-2015-5318
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack. Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 utiliza un salt de acceso público para generar tokens de protección CSRF, lo que hace que sea más fácil para atacantes remotos eludir el mecanismo de protección CSRF a través de un ataque de fuerza bruta. • http://rhn.redhat.com/errata/RHSA-2016-0489.html https://access.redhat.com/errata/RHSA-2016:0070 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 https://access.redhat.com/security/cve/CVE-2015-5318 https://bugzilla.redhat.com/show_bug.cgi?id=1282361 • CWE-352: Cross-Site Request Forgery (CSRF) •