Welcome to our
Cyber Security News Aggregator
.Cyber Tzar
provide acyber security risk management
platform; including automated penetration tests and risk assesments culminating in a "cyber risk score" out of 1,000, just like a credit score.
First slide label
Some representative placeholder content for the first slide.
Second slide label
Some representative placeholder content for the second slide.
Third slide label
Some representative placeholder content for the third slide.
Jenkins - SECURITY-200 / CVE-2015-5323 PoC
published on 2019-02-28 00:14:00 UTC by UnknownContent:
API tokens of other users available to admins
SECURITY-200 / CVE-2015-5323
API tokens of other users were exposed to admins by default. On instances that don’t implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user’s credentials.
Affected versions
All Jenkins LTS releases up to and including 1.625.1
PoC
From the script console:
SECURITY-200 / CVE-2015-5323
API tokens of other users were exposed to admins by default. On instances that don’t implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user’s credentials.
Affected versions
All Jenkins main line releases up to and including 1.637
All Jenkins LTS releases up to and including 1.625.1
PoC
Tested against Jenkins 1.6.37
From the script console:
 |
| run some groovy code to get the token of another user |
 |
| wrong token |
 |
| correct token |
https://blog.carnal0wnage.com/2019/02/jenkins-security-200-cve-2015-5323-poc.html
Published: 2019 02 28 00:14:00
Received: 2024 02 19 11:44:45
Feed: Carnal0wnage and Attack Research Blog
Source: Carnal0wnage and Attack Research Blog
Category: News
Topic: Hacking
Views: 1
