PT-2018-7126 · Jenkins · Jenkins

Taneli Vallo · Published 2018-04-11 · Updated 2022-11-30 · CVE-2017-2599

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2

Description: The issue is related to an insufficient permission check, allowing users with permissions to create new items, such as jobs, to overwrite existing items they do not have access to.

Recommendations: For versions prior to 2.44, update to version 2.44 or later. For versions prior to 2.32.2, update to version 2.32.2 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2017-2599

GHSA-7R4H-2H23-6JQ9

Affected Products

Jenkins

References · 9

• https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-2599 · Security Note
• https://osv.dev/vulnerability/GHSA-7r4h-2h23-6jq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2599 · Vendor Advisory
• https://jenkins.io/security/advisory/2017-02-01 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://t.me/cvenotify/6596 · Telegram Post
• http://securityfocus.com/bid/95949 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599 · Note