Back to feed
EUVD-2022-2398 · Published May 13, 2022
Improper Limitation of a Pathname to a Restricted Directory in Jenkins A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Technologies
Jenkins JenkinsRedhat Openshift Container Platform
Weaknesses
CWE-22
CVSS scores
- v3.08.2
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://www.tenable.com/security/research/tra-2018-43
- http://www.securityfocus.com/bid/106176
- https://access.redhat.com/errata/RHBA-2019:0024
- https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000863
- https://github.com/jenkinsci/jenkins/commit/4ed66e5838476e575a83c3cd13fffb37eefa2f48
Potentially impacted assets
See if this affects your attack surface
