CVE-2018-1000861: Jenkins' Imperfect Authorization Model and the Triple Penetration Technique
This vulnerability is not "Remote Code Execution," but a systemic collapse of Jenkins' core authorization model. Many initially perceive CVE-2018-1000861 as another "Remote Code Execution" (RCE) vulnerability, prompting immediate setup of environments and execution of Proof-of-Concepts (POCs). When I first reproduced it in ...
Publicado em 7-21 23:38