CVE-2013-0330

Vulnerability

CVE-2013-0330 is an unspecified vulnerability in Jenkins that allows remote authenticated users with write access to build arbitrary jobs. Affected versions include Jenkins before 1.502 and Jenkins LTS before 1.480.3. The issue is triggered via unknown attack vectors, as described in the official CVE description [2]. References from Red Hat indicate that a flaw could allow a Jenkins user to build jobs they do not have access to [1][4].

Exploitation

An attacker must have a valid Jenkins account with write access to the system. No additional conditions such as race window timing or user interaction are required based on available references. The exact sequence of steps is not specified, but the attacker leverages missing or insufficient authorization checks to initiate builds of jobs not normally permitted [1][4].

Impact

Successful exploitation allows the attacker to build arbitrary jobs without proper authorization. This can lead to unauthorized execution of build logic, potentially resulting in code execution, data exposure, or unintended resource consumption. The privilege level achieved is that of a user with write access, but the attacker can perform actions beyond their intended scope [1][4].

Mitigation

Jenkins administrators should upgrade to Jenkins version 1.502 or later, or Jenkins LTS version 1.480.3 or later, which contain the fix for this vulnerability. For Red Hat OpenShift Enterprise users, updating to version 1.1.2 addresses the issue, as noted in RHSA-2013:0638 [1]. No workaround is provided for unpatched versions, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.