PT-2018-7139 · Cloudbees+1 · Jenkins

Jean Marsault · Published 2018-05-15 · Updated 2022-05-13 · CVE-2017-2613

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.32.2 Jenkins versions prior to 2.44

Description: The issue allows for a user creation CSRF using GET requests by administrators. This can lead to the creation of a large number of user records, although these records are typically only retained until the system restarts. Administrators' web browsers can be manipulated to create these user records.

Recommendations: For versions prior to 2.32.2, update to version 2.32.2 or later. For versions prior to 2.44, update to version 2.44 or later.

Fix

CSRF

Allocation of Resources Without Limits

Weakness Enumeration

CWE-352

CWE-770

Related Identifiers

CVE-2017-2613

GHSA-PWV6-872C-GCG6

Affected Products

Jenkins

References · 8

• https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601 · Patch
• https://jenkins.io/security/advisory/2017-02-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2613 · Security Note
• https://osv.dev/vulnerability/GHSA-pwv6-872c-gcg6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2613 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2613 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613 · Note
• http://securityfocus.com/bid/95967 · Note