Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-2611

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

Published

2018-05-08T18:29:00.310

Last Modified

2024-11-21T03:23:49.673

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-358
Type: Primary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	jenkins	jenkins	< 2.32.2	Yes
Application	jenkins	jenkins	< 2.44	Yes
Application	redhat	openshift	2.0	Yes
Application	redhat	openshift	3.0	Yes

References

http://www.securityfocus.com/bid/95956 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611 Issue Tracking, Third Party Advisory ([email protected])
https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86 Third Party Advisory ([email protected])
https://jenkins.io/security/advisory/2017-02-01/ Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/95956 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://jenkins.io/security/advisory/2017-02-01/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)