Description

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

Remediation

References

CVE-2015-1810

Related Vulnerabilities

Joomla! Core 3.x.x SQL Injection (3.5.0 - 3.8.5)

WordPress Plugin Post Form-Registration Form-Profile Form for User Profiles and Content Forms for User Submissions Cross-Site Scripting (2.7.2)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-50721)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9465)

Oracle HTTP Server Improper Certificate Validation Vulnerability (CVE-2020-26184)

Severity

Medium

Classification

CVE-2015-1810 CWE-264

Tags

Missing Update Known Vulnerabilities