Improper Privilege Management in Jenkins - CVE-2017-2599
Published: April 11, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31329
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-2599
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Jenkins
Affected software:
Jenkins
Jenkins
Detailed vulnerability description
The vulnerability allows a remote authenticated user to read and manipulate data.
Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).
How to mitigate CVE-2017-2599
Install update from vendor's website.