Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process and allowing a wide variety of impacts.

Remediation

References

CVE-2017-1000356

Related Vulnerabilities

WordPress Plugin Easy Social Icons Cross-Site Scripting (3.1.2)

WordPress Plugin Are You a Human-The Fun Spam Blocker Cross-Site Scripting (1.4.32)

WordPress Plugin WP-Recall-Registration, Profile, Commerce & More Cross-Site Scripting (16.24.47)

WordPress Plugin Remote Upload Arbitrary File Upload (1.2.1)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-34171)

Severity

High

Classification

CVE-2017-1000356 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities