Welcome to our

Cyber Security News Aggregator

.

Cyber Tzar

provide a

cyber security risk management

platform; including automated penetration tests and risk assesments culminating in a "cyber risk score" out of 1,000, just like a credit score.

Jenkins - SECURITY-200 / CVE-2015-5323 PoC

published on 2019-02-28 00:14:00 UTC by Unknown
Content:
API tokens of other users available to admins

SECURITY-200 / CVE-2015-5323

API tokens of other users were exposed to admins by default. On instances that don’t implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user’s credentials.


Affected versions
All Jenkins main line releases up to and including 1.637

All Jenkins LTS releases up to and including 1.625.1

PoC
Tested against Jenkins 1.6.37


From the script console:
run some groovy code to get the token of another user

wrong token

correct token
Article: Jenkins - SECURITY-200 / CVE-2015-5323 PoC - published over 5 years ago.

https://blog.carnal0wnage.com/2019/02/jenkins-security-200-cve-2015-5323-poc.html   
Published: 2019 02 28 00:14:00
Received: 2021 06 06 09:05:30
Feed: Carnal0wnage and Attack Research Blog
Source: Carnal0wnage and Attack Research Blog
Category: News
Topic: Hacking
Views: 3

Custom HTML Block

Click to Open Code Editor