CVE-2012-4438: Input Validation
Published Nov 18, 2019
·Updated
Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
Affected Software
5 affected componentsFixes available
Jenkins Jenkins<1.466.2
Jenkins Jenkins<1.482
maven/org.jenkins-ci.main:jenkins-core>=1.467<1.482
1.482
maven/org.jenkins-ci.main:jenkins-core<1.466.2
1.466.2
debian/jenkins
Event History
Nov 18, 2019
CVE Published
via MITRE·08:46 PM
Data Sourced
via MITRE·08:46 PM
DescriptionWeakness
Apr 23, 2022
Advisory Published
via GitHub·12:40 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-4438?
CVE-2012-4438 is classified as a critical vulnerability due to the ability of remote attackers to execute arbitrary code on the Jenkins master.
2
How do I fix CVE-2012-4438?
To fix CVE-2012-4438, update Jenkins to version 1.482 or later, or to the LTS version 1.466.2 or later.
3
What versions of Jenkins are affected by CVE-2012-4438?
CVE-2012-4438 affects all Jenkins versions before 1.482 and LTS versions before 1.466.2.
4
Can CVE-2012-4438 be exploited remotely?
Yes, CVE-2012-4438 can be exploited remotely by attackers with read and HTTP access to the Jenkins master.
5
Is authentication insufficient in CVE-2012-4438?
Yes, CVE-2012-4438 demonstrates insufficient authentication since it allows attackers with basic access to manipulate Jenkins.