Outdated Jenkins server hosted at OwnCloud.org
O
ownCloud
Submitted None
Actions:
Reported by
computer-engineer
Vulnerability Details
Technical details and impact analysis
###Summary:
The target OwnCloud's server is running an outdated version of _Jenkins server_ which is vulnerable to various attacks.
Server Location: `https://ci.owncloud.org`
Vulnerable Software: `Jenkins ver. 2.27`
###Proof of Exploitability
CVE-2016-3727
**POC URL:** `https://ci.owncloud.org/computer/(master)/api/xml`
>Details:
> The API URL /computer/(master)/api/xml allowed users with the extended read permission for the master node to see some global Jenkins configuration, including the configuration of the security realm.
> Source: https://jenkins.io/security/advisory/2016-05-11/
Additionally, the current software version is also vulnerable to RCE.
>CVE-2017-2608
>XStream remote code execution vulnerability
>Affected Versions: < 2.43
> Source: https://jenkins.io/security/advisory/2017-02-01/
###Recommended Fix
Update Jenkins server to latest version 2.47
Related CVEs
Associated Common Vulnerabilities and Exposures
CVE-2017-2608
HIGH
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).
CVE-2016-3727
UNKNOWN
The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Information Disclosure