What is GHSA-7592-93rm-6gpx?

GHSA-7592-93rm-6gpx is a security advisory published by GitHub Security Advisories with Medium severity. Injection in Jenkins

Which CVE IDs does GHSA-7592-93rm-6gpx cover?

GHSA-7592-93rm-6gpx covers the following CVE IDs: CVE-2018-1000193. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7592-93rm-6gpx?

GHSA-7592-93rm-6gpx has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-7592-93rm-6gpx?

GHSA-7592-93rm-6gpx affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003c= 2.107.2; maven/org.jenkins-ci.main:jenkins-core:\u003e= 2.108, \u003c= 2.120.

GHSA-7592-93rm-6gpxMediumCVSS 4.3

Injection in Jenkins

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000193 →

📋 Description

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:<= 2.107.2
maven/org.jenkins-ci.main:jenkins-core:>= 2.108, <= 2.120

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000193
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-786
https://www.oracle.com/security-alerts/cpuapr2022.html
https://github.com/jenkinsci/jenkins/commit/de7aaab441151fb1760855fec83681c6a8756a45
https://github.com/advisories/GHSA-7592-93rm-6gpx