Description

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2016-0489.html

https://access.redhat.com/errata/RHSA-2016:0070

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Related Vulnerabilities

CVE-2017-12633 Vulnerability in maven package org.apache.camel:camel-hessian

CVE-2018-6874 Vulnerability in maven package org.webjars.npm:auth0-lock

CVE-2021-44549 Vulnerability in maven package org.apache.sling:org.apache.sling.commons.messaging.mail

CVE-2013-7315 Vulnerability in maven package org.springframework:spring-web

CVE-2022-2237 Vulnerability in npm package keycloak-connect

Severity

Critical

Classification

CWE-284

Tags

Vendor Advisory