CVE-2015-5323

2015-11-2520:59:14

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.6

Confidence

Low

EPSS

0.002

Percentile

56.7%

JSON

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.

Affected configurations

Nvd

Node

redhatopenshiftRange≤3.1enterprise

Node

redhatopenshiftMatch2.0

Node

jenkinsjenkinsRange≤1.625.1lts

Node

jenkinsjenkinsRange≤1.637

VendorProductVersionCPE
redhatopenshift*cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
redhatopenshift2.0cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	openshift	*	cpe:2.3:a:redhat:openshift:::::enterprise:::*
redhat	openshift	2.0	cpe:2.3:a:redhat:openshift:2.0:::::::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::lts:::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins::::::::