https://bugzilla.redhat.com/show_bug.cgi?id=1282366
Bug ID: 1282366
Summary: CVE-2015-5323 jenkins: API tokens of other users
available to admins (SECURITY-200)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
API tokens of other users were exposed to admins by default. On instances that
don't implicitly grant RunScripts permission to admins, this allowed admins to
run scripts with another user's credentials.
In very specific circumstances, it allows admins to gain permissions they would
not otherwise have.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=ZqXJZdyVqX&a=cc_unsubscribe