CVE-2015-5323: Medium severity red hat openshift vulnerability
Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Other sources
The following flaw was found in Jenkins:
API tokens of other users were exposed to admins by default. On instances that don't implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user's credentials.
In very specific circumstances, it allows admins to gain permissions they would not otherwise have.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5323?
CVE-2015-5323 is considered a high severity vulnerability due to the potential privilege escalation it allows for remote administrators.
How do I fix CVE-2015-5323?
To fix CVE-2015-5323, upgrade Jenkins to version 1.638 or later, or to LTS version 1.625.2 or later.
Who is affected by CVE-2015-5323?
CVE-2015-5323 affects Jenkins versions before 1.638 and LTS versions before 1.625.2.
What type of vulnerability is CVE-2015-5323?
CVE-2015-5323 is an access control vulnerability that compromises the security of API tokens.
What can happen if CVE-2015-5323 is exploited?
If exploited, CVE-2015-5323 could allow malicious remote administrators to gain unauthorized privileges and execute scripts using another user's API token.