Read the docs
TI-2013-00093 Aliases CVE-2013-0158GHSA-jwfr-h6jp-9p2g

Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and…

Priority LOW 18Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.

Why it matters now

EPSS 0.02455 84th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.main:jenkins-core (Maven): 1.498, 1.480.2Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jenkins-ci.main:jenkins-core (Maven)1.481 to before 1.4981.498Patch availableGHSA-jwfr-h6jp-9p2g
—org.jenkins-ci.main:jenkins-core (Maven)before 1.480.21.480.2Patch availableGHSA-jwfr-h6jp-9p2g
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 1.481 to before 1.498 Fixed in 1.498 Patch available GHSA-jwfr-h6jp-9p2g
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 1.480.2 Fixed in 1.480.2 Patch available GHSA-jwfr-h6jp-9p2g

CPE configurations NVD · 60

CPEVersionsRoleVendor
cpe:2.3:a:cloudbees:jenkins:*:*:*:*:*:*:*:*up to 1.480.3.1VulnerableCloudBees
cpe:2.3:a:jenkins:jenkins:1.400:*:*:*:*:*:*:*1.400VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.401:*:*:*:*:*:*:*1.401VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.402:*:*:*:*:*:*:*1.402VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.403:*:*:*:*:*:*:*1.403VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.404:*:*:*:*:*:*:*1.404VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.405:*:*:*:*:*:*:*1.405VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.406:*:*:*:*:*:*:*1.406VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.407:*:*:*:*:*:*:*1.407VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.408:*:*:*:*:*:*:*1.408VulnerableJenkins
  • cpe:2.3:a:cloudbees:jenkins:*:*:*:*:*:*:*:* Versions up to 1.480.3.1 Vulnerable ·CloudBees
  • cpe:2.3:a:jenkins:jenkins:1.400:*:*:*:*:*:*:* Versions 1.400 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.401:*:*:*:*:*:*:* Versions 1.401 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.402:*:*:*:*:*:*:* Versions 1.402 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.403:*:*:*:*:*:*:* Versions 1.403 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.404:*:*:*:*:*:*:* Versions 1.404 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.405:*:*:*:*:*:*:* Versions 1.405 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.406:*:*:*:*:*:*:* Versions 1.406 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.407:*:*:*:*:*:*:* Versions 1.407 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.408:*:*:*:*:*:*:* Versions 1.408 Vulnerable ·Jenkins
Show 50 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jenkins:jenkins:1.409:*:*:*:*:*:*:*1.409VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.410:*:*:*:*:*:*:*1.410VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.411:*:*:*:*:*:*:*1.411VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.412:*:*:*:*:*:*:*1.412VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.413:*:*:*:*:*:*:*1.413VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.414:*:*:*:*:*:*:*1.414VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.415:*:*:*:*:*:*:*1.415VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.416:*:*:*:*:*:*:*1.416VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.417:*:*:*:*:*:*:*1.417VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.418:*:*:*:*:*:*:*1.418VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.419:*:*:*:*:*:*:*1.419VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.420:*:*:*:*:*:*:*1.420VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.421:*:*:*:*:*:*:*1.421VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.422:*:*:*:*:*:*:*1.422VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.423:*:*:*:*:*:*:*1.423VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424:*:*:*:*:*:*:*1.424VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.425:*:*:*:*:*:*:*1.425VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.426:*:*:*:*:*:*:*1.426VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.427:*:*:*:*:*:*:*1.427VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.428:*:*:*:*:*:*:*1.428VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.429:*:*:*:*:*:*:*1.429VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.430:*:*:*:*:*:*:*1.430VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.431:*:*:*:*:*:*:*1.431VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.432:*:*:*:*:*:*:*1.432VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.433:*:*:*:*:*:*:*1.433VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.434:*:*:*:*:*:*:*1.434VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.435:*:*:*:*:*:*:*1.435VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.436:*:*:*:*:*:*:*1.436VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.437:*:*:*:*:*:*:*1.437VulnerableJenkins
cpe:2.3:a:cloudbees:jenkins:1.466.1.2:-:enterprise:*:*:*:*:*1.466.1.2VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.466.2.1:-:enterprise:*:*:*:*:*1.466.2.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.400:-:lts:*:*:*:*:*1.400VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424:-:lts:*:*:*:*:*1.424VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.447:-:lts:*:*:*:*:*1.447VulnerableCloudBees
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*up to 1.466.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.409.1:*:*:*:*:*:*:*1.409.1VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.409.2:*:*:*:*:*:*:*1.409.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.409.3:*:*:*:*:*:*:*1.409.3VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.1:*:*:*:*:*:*:*1.424.1VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.2:*:*:*:*:*:*:*1.424.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.3:*:*:*:*:*:*:*1.424.3VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.4:*:*:*:*:*:*:*1.424.4VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.5:*:*:*:*:*:*:*1.424.5VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.6:*:*:*:*:*:*:*1.424.6VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.447.1:*:*:*:*:*:*:*1.447.1VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.447.2:*:*:*:*:*:*:*1.447.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.466.1:*:*:*:*:*:*:*1.466.1VulnerableJenkins
cpe:2.3:a:cloudbees:jenkins:1.447.1.1:-:enterprise:*:*:*:*:*1.447.1.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.447.2.2:-:enterprise:*:*:*:*:*1.447.2.2VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.447.3.1:-:enterprise:*:*:*:*:*1.447.3.1VulnerableCloudBees
  • cpe:2.3:a:jenkins:jenkins:1.409:*:*:*:*:*:*:* Versions 1.409 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.410:*:*:*:*:*:*:* Versions 1.410 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.411:*:*:*:*:*:*:* Versions 1.411 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.412:*:*:*:*:*:*:* Versions 1.412 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.413:*:*:*:*:*:*:* Versions 1.413 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.414:*:*:*:*:*:*:* Versions 1.414 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.415:*:*:*:*:*:*:* Versions 1.415 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.416:*:*:*:*:*:*:* Versions 1.416 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.417:*:*:*:*:*:*:* Versions 1.417 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.418:*:*:*:*:*:*:* Versions 1.418 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.419:*:*:*:*:*:*:* Versions 1.419 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.420:*:*:*:*:*:*:* Versions 1.420 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.421:*:*:*:*:*:*:* Versions 1.421 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.422:*:*:*:*:*:*:* Versions 1.422 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.423:*:*:*:*:*:*:* Versions 1.423 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424:*:*:*:*:*:*:* Versions 1.424 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.425:*:*:*:*:*:*:* Versions 1.425 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.426:*:*:*:*:*:*:* Versions 1.426 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.427:*:*:*:*:*:*:* Versions 1.427 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.428:*:*:*:*:*:*:* Versions 1.428 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.429:*:*:*:*:*:*:* Versions 1.429 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.430:*:*:*:*:*:*:* Versions 1.430 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.431:*:*:*:*:*:*:* Versions 1.431 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.432:*:*:*:*:*:*:* Versions 1.432 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.433:*:*:*:*:*:*:* Versions 1.433 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.434:*:*:*:*:*:*:* Versions 1.434 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.435:*:*:*:*:*:*:* Versions 1.435 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.436:*:*:*:*:*:*:* Versions 1.436 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.437:*:*:*:*:*:*:* Versions 1.437 Vulnerable ·Jenkins
  • cpe:2.3:a:cloudbees:jenkins:1.466.1.2:-:enterprise:*:*:*:*:* Versions 1.466.1.2 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.466.2.1:-:enterprise:*:*:*:*:* Versions 1.466.2.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.400:-:lts:*:*:*:*:* Versions 1.400 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424:-:lts:*:*:*:*:* Versions 1.424 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.447:-:lts:*:*:*:*:* Versions 1.447 Vulnerable ·CloudBees
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions up to 1.466.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.409.1:*:*:*:*:*:*:* Versions 1.409.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.409.2:*:*:*:*:*:*:* Versions 1.409.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.409.3:*:*:*:*:*:*:* Versions 1.409.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.1:*:*:*:*:*:*:* Versions 1.424.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.2:*:*:*:*:*:*:* Versions 1.424.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.3:*:*:*:*:*:*:* Versions 1.424.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.4:*:*:*:*:*:*:* Versions 1.424.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.5:*:*:*:*:*:*:* Versions 1.424.5 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.6:*:*:*:*:*:*:* Versions 1.424.6 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.447.1:*:*:*:*:*:*:* Versions 1.447.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.447.2:*:*:*:*:*:*:* Versions 1.447.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.466.1:*:*:*:*:*:*:* Versions 1.466.1 Vulnerable ·Jenkins
  • cpe:2.3:a:cloudbees:jenkins:1.447.1.1:-:enterprise:*:*:*:*:* Versions 1.447.1.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.447.2.2:-:enterprise:*:*:*:*:* Versions 1.447.2.2 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.447.3.1:-:enterprise:*:*:*:*:* Versions 1.447.3.1 Vulnerable ·CloudBees

Remediation

  • Fix · GHSA-jwfr-h6jp-9p2g org.jenkins-ci.main:jenkins-core (Maven) Fixed in 1.498 Advisory →
  • Fix · GHSA-jwfr-h6jp-9p2g org.jenkins-ci.main:jenkins-core (Maven) Fixed in 1.480.2 Advisory →

Red Hat 1 advisory

  • RHSA-2013:0220 Released 2013-01-31 · Red Hat rating Important
    Red Hat OpenShift Enterprise 1.1 update
    • Red Hat OpenShift Enterprise Client Tools rhc-1.3.2-1.3.el6op
    • Red Hat OpenShift Enterprise Infrastructure libmongodb-2.0.2-6.el6op, mongodb-2.0.2-6.el6op, mongodb-devel-2.0.2-6.el6op +20
    • Red Hat OpenShift Enterprise Node jenkins-1.498-1.1.el6op, openshift-origin-cartridge-haproxy-1.4-1.0.3-1.el6op, openshift-origin-cartridge-ruby-1.8-1.0.5-1.el6op +14

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Enterprise Client ToolsFixed RHSA-2013:0220
Red Hat OpenShift Enterprise InfrastructureFixed RHSA-2013:0220
Red Hat OpenShift Enterprise NodeFixed RHSA-2013:0220

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0158
  2. 2026-10-03 Alias added: GHSA-jwfr-h6jp-9p2g

References

Advisory 4

Other 14

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences