PT-2018-7126 · Jenkins · Jenkins

Taneli Vallo · Publicado 2018-04-11 · Atualizado 2022-11-30 · CVE-2017-2599

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2

Description: The issue is related to an insufficient permission check, allowing users with permissions to create new items, such as jobs, to overwrite existing items they do not have access to.

Recommendations: For versions prior to 2.44, update to version 2.44 or later. For versions prior to 2.32.2, update to version 2.32.2 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2017-2599

GHSA-7R4H-2H23-6JQ9

Produtos afetados

Jenkins

Referências · 9

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-2599 · Nota de Segurança
• https://t.me/cvenotify/6596 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-7r4h-2h23-6jq9 · Aviso do Fabricante
• http://securityfocus.com/bid/95949 · Nota
• https://jenkins.io/security/advisory/2017-02-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2599 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599 · Nota