Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process and allowing a wide variety of impacts.

Remediation

References

CVE-2017-1000356

Related Vulnerabilities

WordPress Plugin Quick Paypal Payments Cross-Site Scripting (3.0)

Jenkins Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2021-21615)

WordPress Plugin Slider Hero with Animation, Video Background Cross-Site Scripting (8.4.3)

WordPress Plugin FormBuilder Cross-Site Scripting (1.05)

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-2641)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-352 CVE-2017-1000356