Improper Authentication in Jenkins - CVE-2017-2604
Published: May 15, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31305
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-2604
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to manipulate data.
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
Affected software
Jenkins
How to mitigate CVE-2017-2604
Install update from vendor's website.
Jenkins - update to 2.32.2