vulnwire
5.4med

CVE-2017-2613

Cross-Site Request Forgery in Jenkins

Also known as GHSA-pwv6-872c-gcg6

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.4
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known

jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).

Exploit prediction (EPSS)

1.60% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.05.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CNA3.05.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
NVD3.05.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
NVD2.05.8AV:N/AC:M/Au:N/C:N/I:P/A:P
GitHub3.05.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.jenkins-ci.main:jenkins-core
<2.32.2
>=2.34, <2.44
2.32.2
2.44

Affected products

  • [UNKNOWN] jenkins

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-352 Cross-Site Request Forgery
Technology feeds
Jenkins (RSS, critical only)

References

  • jenkins.io /security/advisory/2017-02-01/ · x_refsource_CONFIRM, x_transferred
  • github.com /jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601 · x_refsource_CONFIRM, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2613 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/95967 · vdb-entry, x_refsource_BID, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-2613 · advisory
  • jenkins.io /security/advisory/2017-02-01 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.