Warning: Jenkins exists a serious security hole that helps hackers gain control of computers of many Vietnamese businesses
Last night, September 18, VSEC - Vietnam Cyber Security Joint Stock Company issued an emergency warning about a serious security hole in the open source application Jenkins.
Last night, September 18, VSEC - Vietnam Cyber Security Joint Stock Company issued an emergency warning about a serious security hole in the open source application Jenkins. If successful exploitation of this vulnerability, hackers can execute unauthorized commands remotely. This serious flaw could affect the computer systems of many Vietnamese businesses.
- Sim vulnerabilities threaten more than 1 billion phones globally
- Warning: 600,000 child navigational devices may be hacked, parents should be careful
According to VSEC, this vulnerability, coded as CVE-2019-10392, was assessed as dangerous as October 8, discovered by Dutch security expert Francesco Soncina. Taking advantage of this vulnerability, hackers can easily gain control of the server, control the entire information system of the enterprise, thereby conducting illegal activities such as spreading confidential data, stealing information. believe…
VSEC security experts said that to successfully exploit this vulnerability, hackers need to have a user account with the right to configure 'Git Client Plugin' and 'Job / Configure (USE_ITEM)' from version 2.8.4 and above. ago. An important factor that allows hackers to execute unauthorized code on the server is the failure to control the input value at the Repository URL parameter in the Git Client Plugin.
Currently, CI (Continuous Integration) system is quite popular among high-tech enterprises in Vietnam. 80% of them have CI system using Jenkins application.
VSEC experts said that on the Internet, there are currently more than 200,000 servers installing Jenkins with the flawed version.
VSEC recommends organizations and businesses to do the following to avoid being affected by this serious flaw.
- Quickly update Jenkins' Git Client Plugin for the latest version.
- Publicly restrict systems in use on the intranet.
- Configure Whitelist of IPs to access critical systems.
- Set strong passwords for system accounts, including low-power accounts.
You should read it
- ProFTPD remote code execution vulnerability affects more than 1 million servers worldwide
- Take a look at the most significant threats from the security world in 2019
- Top 5 most dangerous remote execution vulnerabilities in early 2020, some even automatically infect other computers without users knowing.
- Many serious security holes are found in GitLab
- Detect 2 serious security holes in the Zoom application
- Internet Explorer has vulnerabilities, unused users are still hacked
- Critical RCE vulnerability affects 29 DrayTek router models
- Detecting a series of vulnerabilities can help hackers disable metal detectors at airports
- Microsoft introduced a tool to fix security holes in IE 9 and 10
- Find security holes on every site with Nikto
- Warning of dangerous vulnerabilities on WinRAR, users should uninstall or upgrade to a new version
- AMD patched a series of security holes in the graphics driver for Windows 10
Maybe you are interested
Microsoft tests a Start menu interface similar to iOS How to set up or turn off the AutoPlay feature on Windows 11 How to back up and restore the Start menu layout The 'fake fake' series of images has the potential to cause viewers to be extremely powerful New research shows Tyrannosaurus Tyrannosaurus relies on her sixth sense to 'love'? How to turn off the Administrator account, Guest hidden in Windows 10