Auth bypass in Jenkins
CVE-2017-2611
Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.
EPSS: 0.020 (79.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Jenkins
- Unspecified Jenkins — versions jenkins 2.32.2, jenkins 2.44
- Redhat Openshift — versions 2.0, 3.0
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-2611?
- CVE-2017-2611 is a medium-severity vulnerability in Jenkins, classified under CWE-358. CVSS score: 4.3/10. Published 2018-05-08.
- How severe is CVE-2017-2611?
- Medium severity. CVSS v3 base score is 4.3 out of 10.