Comment on What can we learn from the matrix.org compromise?Comments−krupan7yCan anyone explain the Jenkins vulnerability that was used to initially gain access? Reading the CVEs didn't give me the impression that they enabled remote exploits−bifrost7yMy 5 second lazy summaries of the CVEs:CVE-2019-1003001, CVE-2019-1003002 -> Anyone with read access to Jenkins can own the build environment.CVE-2019-1003000 -> I didn't get a lot of the details on this but it basically looks like "broken sandboxing, you can run bad scripts".This is also a good resource: https://packetstormsecurity.com/files/152132/Jenkins-ACL-Byp...
Comments
Can anyone explain the Jenkins vulnerability that was used to initially gain access? Reading the CVEs didn't give me the impression that they enabled remote exploits
My 5 second lazy summaries of the CVEs:
CVE-2019-1003001, CVE-2019-1003002 -> Anyone with read access to Jenkins can own the build environment.
CVE-2019-1003000 -> I didn't get a lot of the details on this but it basically looks like "broken sandboxing, you can run bad scripts".
This is also a good resource: https://packetstormsecurity.com/files/152132/Jenkins-ACL-Byp...