CVE-2013-2034 Jenkins Cross-Site Request Forgery vulnerabilities

What is CVE-2013-2034?

CVE-2013-2034 is a medium-severity vulnerability in n/a, published on 14 May 2014. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.

Weakness: CWE-352

Which versions are affected by CVE-2013-2034?

4 open source packages ship an affected version, including org.jenkins-ci.main:jenkins-core. It affects 1 product.

Products include Cloudbees Jenkins.

How do I fix CVE-2013-2034?

Upgrade org.jenkins-ci.main:jenkins-core to a fixed version for your release line: 1.509.1 or 1.514.

Is CVE-2013-2034 being exploited?

There is no known exploitation of CVE-2013-2034 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2012-0785 Hash collision attack vulnerability in Jenkins High 7.5
• CVE-2012-6073 Jenkins affected by Open Redirect Vulnerability Medium 5.8
• CVE-2012-6072 Jenkins allows HTTP Injection and Response Splitting Medium 4.3
• CVE-2012-0324 Jenkins allows Cross-Site Scripting (XSS) Medium 4.3
• CVE-2012-0325 Jenkins allows Cross-Site Scripting (XSS) Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fg4r-f9j2-36mw.