PT-2018-5165 · Cloudbees+1 · Jenkins

Jesse Glick · Published 2018-01-29 · Updated 2022-05-14 · CVE-2017-1000354

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.56 and earlier Jenkins version 2.46.1 LTS and earlier

Description The issue allows impersonating any Jenkins user through a login command. The login command in the remoting-based CLI stores the encrypted user name of the successfully authenticated user in a cache file used for further command authentication. Users with sufficient permission to create secrets in Jenkins and download their encrypted values can impersonate any other Jenkins user on the same instance.

Recommendations For Jenkins versions 2.56 and earlier, update to a version later than 2.56 to resolve the issue. For Jenkins version 2.46.1 LTS and earlier, update to a version later than 2.46.1 LTS to resolve the issue. As a temporary workaround, consider restricting the permission to create secrets in Jenkins and download their encrypted values to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-1000354

GHSA-R57F-7XW3-Q2R9

Affected Products

Jenkins

References · 8

• https://jenkins.io/security/advisory/2017-04-26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000354 · Security Note
• https://osv.dev/vulnerability/GHSA-r57f-7xw3-q2r9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000354 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/02d24053bdfeb219d2387a19885a60bdab510479 · Note
• https://web.archive.org/web/20200227174424/http://securityfocus.com/bid/98065 · Note
• http://securityfocus.com/bid/98065 · Note