Description

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

Remediation

References

http://www.securityfocus.com/bid/106176

https://access.redhat.com/errata/RHBA-2019:0024

https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072

https://www.tenable.com/security/research/tra-2018-43

Related Vulnerabilities

CVE-2020-28500 Vulnerability in maven package org.webjars.bower:lodash

CVE-2020-15232 Vulnerability in maven package org.mapfish.print:print-lib

CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-markdown-gfm

CVE-2017-16114 Vulnerability in maven package org.webjars.bower:marked

CVE-2021-23348 Vulnerability in npm package portprocesses

Severity

Critical

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory Exploit