GitHub Advisoryadvisory · Maven

GHSA-wfj3-535m-p6fx Improper Input Validation in Jenkins

HIGH Published 2022-05-14 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-1000391
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-07-01

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.73.3 → fixed in 2.73.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.74, < 2.89 → fixed in 2.89

Description

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.

Related

Alias · CVE (1)

  • CVE-2017-1000391 Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References