PT-2018-5165 · Cloudbees+1 · Jenkins

Jesse Glick · Publicado 2018-01-29 · Atualizado 2022-05-14 · CVE-2017-1000354

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.56 and earlier Jenkins version 2.46.1 LTS and earlier

Description The issue allows impersonating any Jenkins user through a login command. The login command in the remoting-based CLI stores the encrypted user name of the successfully authenticated user in a cache file used for further command authentication. Users with sufficient permission to create secrets in Jenkins and download their encrypted values can impersonate any other Jenkins user on the same instance.

Recommendations For Jenkins versions 2.56 and earlier, update to a version later than 2.56 to resolve the issue. For Jenkins version 2.46.1 LTS and earlier, update to a version later than 2.46.1 LTS to resolve the issue. As a temporary workaround, consider restricting the permission to create secrets in Jenkins and download their encrypted values to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-1000354

GHSA-R57F-7XW3-Q2R9

Produtos afetados

Jenkins

Referências · 8

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/02d24053bdfeb219d2387a19885a60bdab510479 · Nota
• https://jenkins.io/security/advisory/2017-04-26 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000354 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-r57f-7xw3-q2r9 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000354 · Aviso do Fabricante
• https://web.archive.org/web/20200227174424/http://securityfocus.com/bid/98065 · Nota
• http://securityfocus.com/bid/98065 · Nota