GHSA-wr6p-j63r-xqhv

Source

https://github.com/advisories/GHSA-wr6p-j63r-xqhv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-wr6p-j63r-xqhv/GHSA-wr6p-j63r-xqhv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wr6p-j63r-xqhv

Aliases

CVE-2012-4438

Published

2022-04-23T00:40:12Z

Modified

2025-03-12T16:27:11.601982Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins allows Data Insertion and Execution of Code by those with Read and HTTP Access

Details

Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.

Database specific

{
    "nvd_published_at": "2019-11-18T21:15:00Z",
    "github_reviewed_at": "2025-03-12T15:52:59Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "github_reviewed": true,
    "severity": "HIGH"
}

References

Affected packages

Maven / org.jenkins-ci.main:jenkins-core

Package

Name: org.jenkins-ci.main:jenkins-core; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.main/jenkins-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.466.2

Affected versions

1.*

1.396

1.397

1.398

1.399

1.400

1.401

1.403

1.404

1.405

1.406

1.407

1.408

1.409

1.409.1

1.409.2

1.409.3

1.410

1.411

1.412

1.413

1.414

1.415

1.416

1.417

1.418

1.419

1.420

1.421

1.422

1.423

1.424

1.424.1

1.424.2

1.424.3

1.424.4

1.424.5

1.424.6

1.425

1.426

1.427

1.428

1.429

1.430

1.431

1.432

1.433

1.434

1.435

1.436

1.437

1.438

1.439

1.440

1.441

1.442

1.443

1.444

1.445

1.446

1.447

1.447.1

1.447.2

1.448

1.449

1.450

1.451

1.452

1.453

1.454

1.455

1.456

1.457

1.458

1.459

1.460

1.461

1.462

1.463

1.464

1.465

1.466

1.466.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-wr6p-j63r-xqhv/GHSA-wr6p-j63r-xqhv.json"

Maven / org.jenkins-ci.main:jenkins-core

Package

Name: org.jenkins-ci.main:jenkins-core; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.main/jenkins-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.467

Fixed

1.482

Affected versions

1.*

1.467

1.468

1.469

1.470

1.471

1.472

1.473

1.474

1.475

1.476

1.477

1.478

1.479

1.480

1.480.1

1.480.2

1.480.3

1.481

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-wr6p-j63r-xqhv/GHSA-wr6p-j63r-xqhv.json"