Description

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

Remediation

References

CVE-2015-1810

Related Vulnerabilities

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-2561)

Oracle JRE CVE-2022-21296 Vulnerability (CVE-2022-21296)

PHP Out-of-bounds Write Vulnerability (CVE-2017-9228)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-4073)

phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-4219)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2015-1810