PT-2018-5167 · Cloudbees+1 · Jenkins

Steve Marlowe · Published 2018-01-29 · Updated 2022-05-14 · CVE-2017-1000356

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.56 and earlier Jenkins version 2.46.1 LTS and earlier

Description The issue exists in the Jenkins user database authentication realm. It allows creating an account if signup is enabled, or creating an account if the victim is an administrator. This could possibly delete the existing default admin user, allowing a wide variety of impacts.

Recommendations For Jenkins versions 2.56 and earlier, update to a version later than 2.56 to resolve the issue. For Jenkins version 2.46.1 LTS and earlier, update to a version later than 2.46.1 LTS to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-1000356

GHSA-85WQ-PQHP-HMQ6

Affected Products

Jenkins

References · 9

• https://jenkins.io/security/advisory/2017-04-26 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-85wq-pqhp-hmq6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000356 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000356 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/23f4809e6c10a221e9d67f2e841536845387b42d · Note
• https://github.com/jenkinsci/jenkins/commit/3c5e5ca63d9a1ac1c4087682dc0d426625eafed8 · Note
• https://github.com/jenkinsci/jenkins/commit/e69c28e44dae41322112471e1c80f840bde314d4 · Note
• http://securityfocus.com/bid/98062 · Note