CVE-2017-2611

Description

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

Risk Information

Base Score

4.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS Score

Exploitation Probability

0.293

Associated Vulnerability

Vulnerability	OS Platform
Vulnerability CVE-2017-2601,CVE-2017-2611 are affected in Jenkins 2.43	Windows
Multiple vulnerabilities are fixed in Jenkins-Core 2.44	Windows
Multiple vulnerabilities are fixed in Jenkins-Core for Linux 2.44	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234