Bug 958958 (CVE-2013-2034) - CVE-2013-2034 Jenkins: Multiple CSRF in MavenAbstractArtifactRecord.doRedeploy and Jenkins.doEval
Summary: CVE-2013-2034 Jenkins: Multiple CSRF in MavenAbstractArtifactRecord.doRedeplo...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-2034
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 958964 988663
Blocks: 958963
TreeView+ depends on / blocked
 
Reported: 2013-05-02 19:15 UTC by Kurt Seifried
Modified: 2021-02-17 07:44 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-02-13 00:50:22 UTC
Embargoed:

Attachments (Terms of Use)

Description Kurt Seifried 2013-05-02 19:15:44 UTC 
Reported by Jesse Glick:

Multiple CSRF flaws exist in Jenkins, one allows remote users with the 
"ADMINISTER" privilege to run Jelly scripts which would allow arbitrary Java 
code execution.
Comment 2 Vincent Danen 2013-05-02 21:13:33 UTC 
This is now public

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02
https://issues.jenkins-ci.org/browse/SECURITY-63
https://issues.jenkins-ci.org/browse/SECURITY-69
Comment 4 Garth Mollett 2013-08-29 22:25:21 UTC 
This issue has been addressed in following products:

  Red Hat OpenShift Enterprise 1.2

Via RHEA-2013:1032 https://rhn.redhat.com/errata/RHEA-2013-1032.html
Note You need to log in before you can comment on or make changes to this bug.