PT-2018-7131 · Cloudbees+1 · Jenkins

Daniel Beck · Publicado 2018-05-15 · Atualizado 2022-05-13 · CVE-2017-2604

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2

Description: The issue allows low privilege users to act on administrative monitors due to inconsistent protection by permission checks.

Recommendations: For versions prior to 2.44, update to version 2.44 or later. For versions prior to 2.32.2, update to version 2.32.2 or later.

Correção

Improperly Implemented Security Check for Standard

Improper Authentication

Enumeração de Fraquezas

CWE-358

CWE-287

Identificadores relacionados

CVE-2017-2604

GHSA-M93H-5QMX-PPHG

Produtos afetados

Jenkins

Referências · 8

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/6efcf6c2ac39bc5c59ac7251822be8ddf67ceaf8 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2604 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2604 · Nota de Segurança
• http://securityfocus.com/bid/95959 · Nota
• https://osv.dev/vulnerability/GHSA-m93h-5qmx-pphg · Aviso do Fabricante
• https://jenkins.io/security/advisory/2017-02-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2604 · Aviso do Fabricante