PT-2018-5266 · Jenkins · Jenkins

Jesse Glick · Publicado 2018-01-24 · Atualizado 2022-05-14 · CVE-2017-1000502

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 1.37 and earlier

Description The issue allows users with certain permissions to configure an EC2 agent in a way that it can run arbitrary shell commands on the master node. This can happen whenever the agent is supposed to be launched. The configuration of these agents now requires a specific permission, typically only granted to administrators.

Recommendations For Jenkins versions 1.37 and earlier, ensure that the configuration of EC2 agents is restricted to users with the 'Run Scripts' permission, typically only granted to administrators, to prevent unauthorized access and potential exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-1000502

GHSA-WP79-CPV2-9G7M

Produtos afetados

Jenkins

Referências · 4

• https://jenkins.io/security/advisory/2017-12-06 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000502 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wp79-cpv2-9g7m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000502 · Nota de Segurança