#VU43056 Input validation error in Jenkins - CVE-2012-6073

Vulnerability identifier: #VU43056

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-6073

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jenkins
Server applications / Application servers

Vendor: Jenkins

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Jenkins: 1.401 - 1.466.2.1

---

External links
https://rhn.redhat.com/errata/RHSA-2013-0220.html
https://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
https://www.openwall.com/lists/oss-security/2012/12/28/1
https://bugzilla.redhat.com/show_bug.cgi?id=890608
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.