4 ms·
Can anyone explain the Jenkins vulnerability that was used to initially gain access? Reading the CVEs didn't give me the impression that they enabled remote ex
by krupan 8y ago
Can anyone explain the Jenkins vulnerability that was used to initially gain access? Reading the CVEs didn't give me the impression that they enabled remote exploits
- bifrost 8y agoMy 5 second lazy summaries of the CVEs: CVE-2019-1003001, CVE-2019-1003002 -> Anyone with read access to Jenkins can own the build environment. CVE-2019-1003000 -> I didn't get a lot of the details on this but it basically looks like "broken sandboxing, you can run bad scripts". This is also a good resource: https://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html https://packetstormsecurity.com/files/152132/Jenkins-ACL-Byp...