CVE-2013-0158
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
- EPSS
- 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cloudbees:jenkins
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jwfr-h6jp-9p2g | Maven | org.jenkins-ci.main:jenkins-core | >=1.481 <1.498 | 1.498 |
| GHSA-jwfr-h6jp-9p2g | Maven | org.jenkins-ci.main:jenkins-core | <1.480.2 | 1.480.2 |
References
- http://rhn.redhat.com/errata/RHSA-2013-0220.html
- http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-01-04.cb
- http://www.openwall.com/lists/oss-security/2013/01/07/4
- https://bugzilla.redhat.com/show_bug.cgi?id=892795
- https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04