Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2012-4438

Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.

VectorNETWORK

PublishedNov 18, 2019, 21:15

Published Bysecalert@redhat.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.main:jenkins-core(Maven)01.466.2N/A

org.jenkins-ci.main:jenkins-core(Maven)1.4671.482N/A

References

http://www.openwall.com/lists/oss-security/2012/09/21/2
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4438
https://security-tracker.debian.org/tracker/CVE-2012-4438
https://www.cloudbees.com/jenkins-security-advisory-2012-09-17

Weakness Type

CWE-20

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK