CVE-2014-2058

2014-10-1700:00:00

ubuntu.com

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

66.3%

JSON

BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote
authenticated users to bypass access restrictions and execute arbitrary
jobs by configuring a job to trigger another job. NOTE: this vulnerability
exists because of an incomplete fix for CVE-2013-7330.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739067>

Notes

Author	Note
seth-arnold	SECURITY-109 is not visible as of 2014-02-21; this appears to be a result of an incomplete fix for SECURITY-55, which is also not visible and unfixed in Ubuntu as of 2014-02-21. See also CVE-2013-7330.