What is GHSA-37wm-28rm-56vw?

GHSA-37wm-28rm-56vw is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation

Which CVE IDs does GHSA-37wm-28rm-56vw cover?

GHSA-37wm-28rm-56vw covers the following CVE IDs: CVE-2015-1810. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-37wm-28rm-56vw?

GHSA-37wm-28rm-56vw affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 1.597, \u003c 1.600; maven/org.jenkins-ci.main:jenkins-core:\u003c 1.596.1.

GHSA-37wm-28rm-56vwMedium

Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

March 13, 2025

🔗 CVE IDs covered (1)

CVE-2015-1810 →

📋 Description

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 1.597, < 1.600
maven/org.jenkins-ci.main:jenkins-core:< 1.596.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2015-1810
https://access.redhat.com/errata/RHSA-2016:0070
https://bugzilla.redhat.com/show_bug.cgi?id=1205627
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27
http://rhn.redhat.com/errata/RHSA-2015-1844.html
https://github.com/advisories/GHSA-37wm-28rm-56vw