What is CVE-2017-1000086?

CVE-2017-1000086 is a high-severity vulnerability in Jenkins Periodic Backup, classified under Missing Authorization. CVSS score: 8.0/10. Published 2017-10-05.

How severe is CVE-2017-1000086?

High severity. CVSS v3 base score is 8.0 out of 10.

Auth bypass in Jenkins Periodic Backup

CVE-2017-1000086

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

Vulnerability class: Broken Access Control

EPSS: 0.011 (61.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Jenkins Periodic_backup — versions 1.0, 1.1, 1.2
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-1000086?: CVE-2017-1000086 is a high-severity vulnerability in Jenkins Periodic Backup, classified under Missing Authorization. CVSS score: 8.0/10. Published 2017-10-05.
How severe is CVE-2017-1000086?: High severity. CVSS v3 base score is 8.0 out of 10.