Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Jenkins: Unauthorized Data Insertion and Code Execution via Remote Access

CVE-2012-4438 · published 6 years ago
Summary

A security issue in Jenkins allows attackers with access to the Jenkins master server to insert data and run malicious code, potentially compromising the security and integrity of the system. This affects versions of Jenkins prior to 1.482 and 1.466.2 LTS. To ensure security, update Jenkins to the latest version or patch level.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.466.2.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.482.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core < 1.466.2
>= 1.467, < 1.482
Fix: upgrade to 1.466.2
– jenkins jenkins < 1.466.2
< 1.482
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
Original advisory text
Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published18 Nov 2019
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-wr6p-j63r-xqhv · GHSA
CVE-2012-4438 · NVD
Track software like this
Free during beta