MEDIUM
Jenkins: lack of access control in Exclusion plugin (SECURITY-53)
Published Nov 25, 2013
5.3
MEDIUMCVSS 4.0
EPSS 1.15%
Description
The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.
Affected products
No data.
OR
- ≤ 0.8
- 0.6
- 0.7
No data.
OpenShift Enterprise 1
jenkins
Not affected
Red Hat OpenShift Enterprise 2
jenkins
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| OpenShift Enterprise 1 | jenkins | Not affected | n/a |
| Red Hat OpenShift Enterprise 2 | jenkins | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Not affected. This issue did not affect Jenkins as shipped with various Red Hat products, as they do not include the Jenkins Exclusion plugin.
References (9)
- https://access.redhat.com/security/cve/CVE-2013-6373 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1032397 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-6198 Advisory
- https://github.com/advisories/GHSA-2q8v-439j-6p77 Advisory
- https://github.com/jenkinsci/exclusion-plugin/commit/847f9aeb407c0f47046d184080c9e2c2e3720311
- https://nvd.nist.gov/vuln/detail/CVE-2013-6373
- https://wiki.jenkins-ci.org/display/JENKINS/Exclusion-Plugin x_refsource_CONFIRM
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20 x_refsource_MISCVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2013-6373
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Nov 25, 2013
Updated Aug 6, 2024
Reserved Nov 4, 2013
Link CVE-2013-6373
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2013-6198 GHSA-2Q8V-439J-6P77 Assigner redhat
Published Nov 25, 2013
Updated Aug 6, 2024
Exploited since n/a
Link EUVD-2013-6198