vulnwire
4.3med

CVE-2017-2600

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Also known as GHSA-wj5c-j656-h5fw

Published 8 y ago · modified 4 mo ago · JSON

CVSS
4.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known

In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).

Exploit prediction (EPSS)

1.03% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.jenkins-ci.main:jenkins-core
<2.32.2
>=2.34, <2.44
2.32.2
2.44

Affected products

  • [UNKNOWN] jenkins

Classification

Weakness
  • CWE-325 Missing Cryptographic Step
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds
Jenkins (RSS, critical only)

References

  • jenkins.io /security/advisory/2017-02-01/ · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/95954 · vdb-entry, x_refsource_BID, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2600 · x_refsource_CONFIRM, x_transferred
  • github.com /jenkinsci/jenkins/commit/0f92cd08a19207de2cceb6a2f4e3e9f92fdc0899 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-2600 · advisory
  • github.com /jenkinsci/jenkins · package
  • jenkins.io /security/advisory/2017-02-01 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.