What is GHSA-mm9c-4cv4-7rfv?

GHSA-mm9c-4cv4-7rfv is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins allows for Privilege Escalation by Remote Authenticated Users

Which CVE IDs does GHSA-mm9c-4cv4-7rfv cover?

GHSA-mm9c-4cv4-7rfv covers the following CVE IDs: CVE-2015-1806. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mm9c-4cv4-7rfv?

GHSA-mm9c-4cv4-7rfv affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 1.597, \u003c 1.600; maven/org.jenkins-ci.main:jenkins-core:\u003c 1.596.1.

GHSA-mm9c-4cv4-7rfvMedium

Jenkins allows for Privilege Escalation by Remote Authenticated Users

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

March 13, 2025

🔗 CVE IDs covered (1)

CVE-2015-1806 →

📋 Description

The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 1.597, < 1.600
maven/org.jenkins-ci.main:jenkins-core:< 1.596.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2015-1806
https://access.redhat.com/errata/RHSA-2016:0070
https://bugzilla.redhat.com/show_bug.cgi?id=1205620
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27
http://rhn.redhat.com/errata/RHSA-2015-1844.html
https://github.com/advisories/GHSA-mm9c-4cv4-7rfv