4 ms·
What could the attack be there? Aren’t Jenkins usually private for employees use?
by therealdrag0 5y ago
What could the attack be there? Aren’t Jenkins usually private for employees use?
- mwarkentin 5y agoPrivilege escalation for a malicious employee I suppose. Also I believe there are public Jenkins instances used for OS projects, etc. aren't there?
- hn_throwaway_99 5y agoI agree with this, I think Jenkins as an attack vector is likely to be low. It's very possible, for example, to pull in a malicious dependency that then output a message that was logged and took advantage of this vulnerability. But, at that point, if you've already pulled in a malicious dependency you're probably already screwed by an easier method than this log4j issue.