CVE-2015-1806

2015-10-1620:59:04

CWE-264

redhat

web.nvd.nist.gov

cve-2015-1806

jenkins

security

remote code execution

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

7.7

Confidence

High

EPSS

0.005

Percentile

77.2%

JSON

The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.

Affected configurations

Nvd

Node

jenkinsjenkinsRange≤1.580.3lts

Node

jenkinsjenkinsRange≤1.599

Node

redhatopenshiftRange≤3.1enterprise

VendorProductVersionCPE
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
redhatopenshift*cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::lts:::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins::::::::
redhat	openshift	*	cpe:2.3:a:redhat:openshift:::::enterprise:::*