jenkinsci/jenkins · Security
Jenkins allows HTTP Injection and Response Splitting
- GHSA ID
- GHSA-2q8v-qx2x-hxjx
- CVE ID
- CVE-2012-6072
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Description
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CWEs
- CWE-20 · Improper Input Validation
- CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-6072 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=890607 ↗
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20 ↗
- http://rhn.redhat.com/errata/RHSA-2013-0220.html ↗
- http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb ↗
- https://github.com/advisories/GHSA-2q8v-qx2x-hxjx ↗