PT-2018-7139 · Cloudbees+1 · Jenkins

Jean Marsault · Publicado 2018-05-15 · Atualizado 2022-05-13 · CVE-2017-2613

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.32.2 Jenkins versions prior to 2.44

Description: The issue allows for a user creation CSRF using GET requests by administrators. This can lead to the creation of a large number of user records, although these records are typically only retained until the system restarts. Administrators' web browsers can be manipulated to create these user records.

Recommendations: For versions prior to 2.32.2, update to version 2.32.2 or later. For versions prior to 2.44, update to version 2.44 or later.

Correção

CSRF

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-352

CWE-770

Identificadores relacionados

CVE-2017-2613

GHSA-PWV6-872C-GCG6

Produtos afetados

Jenkins

Referências · 8

• https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601 · Correção
• https://jenkins.io/security/advisory/2017-02-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2613 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pwv6-872c-gcg6 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2613 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613 · Nota
• https://osv.dev/vulnerability/CVE-2017-2613 · Aviso do Fabricante
• http://securityfocus.com/bid/95967 · Nota