← Retour aux CVEs

CVE-2018-1000068

MEDIUM

5.3

Description

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.

Details CVE

Score CVSS v3.15.3

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie2/16/2018

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

jenkins:jenkinsoracle:communications_cloud_native_core_automated_test_suite

Faiblesses (CWE)

CWE-200

References

http://www.securityfocus.com/bid/103101(cve@mitre.org)

https://jenkins.io/security/advisory/2018-02-14/#SECURITY-717(cve@mitre.org)

https://www.oracle.com/security-alerts/cpuapr2022.html(cve@mitre.org)

http://www.securityfocus.com/bid/103101(af854a3a-2127-422b-91ae-364da2661108)

https://jenkins.io/security/advisory/2018-02-14/#SECURITY-717(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.