CVE-2012-4438

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
jenkins	jenkins	1.447.2

References

http://www.openwall.com/lists/oss-security/2012/09/21/2Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4438Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-4438Third Party Advisory
https://www.cloudbees.com/jenkins-security-advisory-2012-09-17Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/09/21/2Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4438Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-4438Third Party Advisory
https://www.cloudbees.com/jenkins-security-advisory-2012-09-17Vendor Advisory

Timeline

Published: Nov 18, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-44396.1Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTM CVE-2012-44406.1Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTM CVE-2012-44416.1Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTM CVE-2012-44424.7Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which migh CVE-2012-44436.9Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to ga CVE-2012-44445.0The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network re CVE-2012-44454.3Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in ho CVE-2012-44466.8The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without c CVE-2012-44476.8Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash CVE-2012-44486.8Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authenticatio CVE-2012-44499.8Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security fe CVE-2012-44506.0389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticat