GHSA-7r4h-2h23-6jq9

ghsaUSosv

Incorrect Authorization in Jenkins

view advisory published 2022-05-13Licence: CC-BY-4.0

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-2599US	medium5.4OT elevated	1.08% (65th)	—	2018-04-11
Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599WEB
https://github.com/jenkinsci/jenkinsPACKAGE
https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89WEB
https://jenkins.io/security/advisory/2017-02-01WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-2599ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan