What is CVE-2017-1000104?

CVE-2017-1000104 is a medium-severity vulnerability in Jenkins Config File Provider, classified under Improper Privilege Management. CVSS score: 6.5/10. Published 2017-10-05.

How severe is CVE-2017-1000104?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Privilege escalation in Jenkins Config File Provider

CVE-2017-1000104

The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient permissions to configure the provided files, view the configuration of the folder in which the configuration files are defined, or have Job/Configure permissions to a job able to use these files.

Vulnerability class: Privilege Escalation

EPSS: 0.008 (53.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Jenkins Config_file_provider
N/a — versions n/a

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-1000104?: CVE-2017-1000104 is a medium-severity vulnerability in Jenkins Config File Provider, classified under Improper Privilege Management. CVSS score: 6.5/10. Published 2017-10-05.
How severe is CVE-2017-1000104?: Medium severity. CVSS v3 base score is 6.5 out of 10.