CVE-2017-2611CWE-358

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389)

Medium · published May 8, 2018

CVSS v3.0
4.3
EPSS
2%
Percentile
79.9
In the wild
Unconfirmed
What it is

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01935 · 79.9th percentile
Weakness
CWE-358 · Improperly Implemented Security Check for Standard
Published
2018-05-08T18:00Z
EPSS history
Timeline
  • 08 MAY 18:00Z
    Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389)
    cvelistv5