CVE-2015-1810 – org.jenkins-ci.main:jenkins-core

Package

Manager: maven
Name: org.jenkins-ci.main:jenkins-core
Vulnerable Version: >=1.597 <1.600 || >=0 <1.596.1

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS: 0.00366 pctl0.57839

Details

Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

Metadata

Created: 2022-05-17T03:53:32Z
Modified: 2025-03-13T19:14:50Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-37wm-28rm-56vw/GHSA-37wm-28rm-56vw.json
CWE IDs: ["CWE-287"]
Alternative ID: GHSA-37wm-28rm-56vw
Finding: F039
Auto approve: 1