CVE-2017-2599

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).

Published: Apr 11, 2018
Updated: May 9, 2024
CVE: CVE-2017-2599
GHSA: GHSA-7r4h-2h23-6jq9
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CVSS v2:

Severity: Medium
Score: 5.5
AV:N/AC:L/Au:S/C:P/I:P/A:N

CWEs:

CWE-863

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.32.2
jenkins / jenkins	-	2.44
org.jenkins-ci.main / jenkins-core	-	2.32.2
org.jenkins-ci.main / jenkins-core	2.34	2.44

http://www.securityfocus.com/bid/95949
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599
https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89
https://jenkins.io/security/advisory/2017-02-01/

Vulnerability Database

289,784

CVE-2017-2599