CVEvulnerability

CVE-2017-2611

4.3 MEDIUM Published 2018-05-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-05-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0 ([email protected])
4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:P
Weaknesses
CWE-358, CWE-863

Description

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

Affected configurations

• jenkins jenkins (< 2.32.2) • jenkins jenkins (< 2.44) • redhat openshift 2.0 • redhat openshift 3.0

Related

Weakness · CWE (2)

  • CWE-358 Improperly Implemented Security Check for Standard weakness
  • CWE-863 Incorrect Authorization weakness

References