vulnwire
4.3med

CVE-2017-2606

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Also known as GHSA-6967-9vvv-4cmm

Published 8 y ago · modified 4 mo ago · JSON

CVSS
4.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 79%
Public exploits
0
none known

Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction.

Exploit prediction (EPSS)

1.81% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.jenkins-ci.main:jenkins-core
<2.32.2
>=2.34, <2.44
2.32.2
2.44

Affected products

  • unspecified jenkins

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds
Jenkins (RSS, critical only)

References

  • jenkins.io /security/advisory/2017-02-01/ · x_refsource_CONFIRM, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2606 · x_refsource_CONFIRM, x_transferred
  • github.com /jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51266b63719 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/95962 · vdb-entry, x_refsource_BID, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-2606 · advisory
  • github.com /jenkinsci/jenkins · package
  • jenkins.io /security/advisory/2017-02-01 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.