CVE-2015-1810: Medium severity Jenkins Jenkins vulnerability
For users using "'Jenkins' own user database" setting, Jenkins doesn't refuse reserved names, thus allowing privilege escalation.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27
Other sources
The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1810?
CVE-2015-1810 has a medium severity rating due to its potential to allow privilege escalation through reserved names.
How do I fix CVE-2015-1810?
To fix CVE-2015-1810, upgrade Jenkins to version 1.600 or later, or LTS to version 1.596.1 or later.
What versions of Jenkins are affected by CVE-2015-1810?
CVE-2015-1810 affects Jenkins versions prior to 1.600 and LTS versions prior to 1.596.1.
Can CVE-2015-1810 be exploited remotely?
Yes, CVE-2015-1810 can be exploited remotely by an attacker to gain unauthorized privileges.
What is the impact of CVE-2015-1810?
The impact of CVE-2015-1810 is that unauthorized users can create reserved usernames, potentially gaining elevated privileges within Jenkins.