Incorrect Authorization in Jenkins

Also known as GHSA-7r4h-2h23-6jq9

Published 8 y ago 2018-04-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.4

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.1%

percentile 65%

Public exploits

none known

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).

Exploit prediction (EPSS)

1.08% probability of exploitation in the next 30 days, higher than 65% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.4	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`
NVD	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`
CNA	3.0	5.4	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`
NVD	2.0	5.5	`AV:N/AC:L/Au:S/C:P/I:P/A:N`
GitHub	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.jenkins-ci.main:jenkins-core`	<2.32.2 >=2.34, <2.44	2.32.2 2.44

Affected products

[UNKNOWN] jenkins

Classification

Weakness

CWE-863 Incorrect Authorization

Technology feeds

Jenkins (RSS, critical only)

References

securityfocus.com /bid/95949 · vdb-entry, x_refsource_BID, x_transferred
jenkins.io /security/advisory/2017-02-01/ · x_refsource_CONFIRM, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2599 · x_refsource_CONFIRM, x_transferred
github.com /jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-2599 · advisory
github.com /jenkinsci/jenkins · package
jenkins.io /security/advisory/2017-02-01 · web

Sources

CVE List: CVE-2017-2599
GitHub Advisory: GHSA-7r4h-2h23-6jq9
NVD: CVE-2017-2599

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary