CVE-2013-0158
published 2013-02-24CVE-2013-0158: Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1…
PriorityP271low2.6CVSS 2.0
AVNACHAuNCPINAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.46%
82.4th percentile
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
Affected
60 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudbees | jenkins | <= 1.480.3.1 | — |
| cloudbees | jenkins | — | — |
| cloudbees | jenkins | — | — |
| cloudbees | jenkins | — | — |
| cloudbees | jenkins | — | — |
| cloudbees | jenkins | — | — |
| cloudbees | jenkins | — | — |
| cloudbees | jenkins | — | — |
| cloudbees | jenkins | — | — |
| jenkins | jenkins | <= 1.466.2 | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
| jenkins | jenkins | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is only exploitable when a Jenkins instance has slaves attached AND anonymous read access is enabled — both conditions must be true for exposure ↗
- →Attack vector is HTTP access to the Jenkins server by an unauthenticated remote attacker to retrieve the master cryptographic key ↗
- →Successful key retrieval enables follow-on arbitrary code execution on the Jenkins master or impersonation of arbitrary users via REST API calls — monitor for anomalous REST API authentication attempts ↗
- ·Vulnerability only applies to Jenkins instances with at least one slave attached; standalone masters without slaves are not affected ↗
- ·Users who have regenerated their API tokens are partially protected — those regenerated tokens cannot be impersonated even if the master key is obtained ↗
- ·The master cryptographic key protects sensitive data in configuration files under $JENKINS_HOME, HTML forms, REST API authentication, and slave-to-master authentication ↗
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
vulncheck2.6LOW
vendor_redhat2.6LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins: remote unauthenticated retrieval of master cryptographic key (Jenkins Security Advisory 2013-01-04)
vendor_redhat·2013-01-04·CVSS 2.6
CVE-2013-0158 [LOW] jenkins: remote unauthenticated retrieval of master cryptographic key (Jenkins Security Advisory 2013-01-04)
jenkins: remote unauthenticated retrieval of master cryptographic key (Jenkins Security Advisory 2013-01-04)
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
OSV
Jenkins allows attackers to obtain the master cryptographic key
osv·2022-05-05
CVE-2013-0158 [LOW] Jenkins allows attackers to obtain the master cryptographic key
Jenkins allows attackers to obtain the master cryptographic key
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
GHSA
Jenkins allows attackers to obtain the master cryptographic key
ghsa·2022-05-05
CVE-2013-0158 [LOW] Jenkins allows attackers to obtain the master cryptographic key
Jenkins allows attackers to obtain the master cryptographic key
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
VulnCheck
Jenkins Cryptographic Key Security Bypass
vulncheck·2013·CVSS 2.6
CVE-2013-0158 [LOW] Jenkins Cryptographic Key Security Bypass
Jenkins Cryptographic Key Security Bypass
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
Affected: cloudbees jenkins
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465/
Suricata
ET MALWARE EvilGrab/Vidgrab Checkin
suricata·2013-09-04
CVE-2012-0158 ET MALWARE EvilGrab/Vidgrab Checkin
ET MALWARE EvilGrab/Vidgrab Checkin
Rule: alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE EvilGrab/Vidgrab Checkin"; flow:established,to_server; content:"|7c 28|"; pcre:"/^\d{1,3}\x2e\d{1,3}\x2e\d{1,3}\x2e\d{1,3}/R"; content:"|29 7c|"; within:2; pcre:"/^\d{1,5}/R"; content:"|7c|Win"; within:4; reference:url,contagiodump.blogspot.com.br/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; classtype:command-and-control; sid:2017413; rev:4; metadata:created_at 2013_09_04, signature_severity Major, updated_at 2024_03_06;)
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2013-0220.htmlhttp://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-01-04.cbhttp://www.openwall.com/lists/oss-security/2013/01/07/4https://bugzilla.redhat.com/show_bug.cgi?id=892795https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04https://github.com/jenkinsci/jenkins/commit/4895eaafca468b7f0f1a3166b2fca7414f0d5da5https://github.com/jenkinsci/jenkins/commit/94a8789b699132dd706021a6be1b78bc47f19602https://github.com/jenkinsci/jenkins/commit/a9aff088f327278a8873aef47fa8f80d3c5932fdhttps://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04http://rhn.redhat.com/errata/RHSA-2013-0220.htmlhttp://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-01-04.cbhttp://www.openwall.com/lists/oss-security/2013/01/07/4https://bugzilla.redhat.com/show_bug.cgi?id=892795https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04https://github.com/jenkinsci/jenkins/commit/4895eaafca468b7f0f1a3166b2fca7414f0d5da5https://github.com/jenkinsci/jenkins/commit/94a8789b699132dd706021a6be1b78bc47f19602https://github.com/jenkinsci/jenkins/commit/a9aff088f327278a8873aef47fa8f80d3c5932fdhttps://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04
2013-02-24
Published
Exploited in the wild