logo

Database

Improper authorization control for web services In org.jenkins-ci.main:jenkins-core

Description

Jenkins does not invalidate the API token when a user is deleted Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2014-20622. NVD-2014-20623. OSV-2014-20624. GCVE-2014-2062

References

1. https://github.com/jenkinsci/jenkins/commit/5548b5220cfd496831b5721124189ff18fbb12a32. https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-143. http://www.openwall.com/lists/oss-security/2014/02/21/2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.