CVE-2017-2604: jenkins
CVSS: 4.3v3.0MediumModified
AliasesGHSA-m93h-5qmx-pphg
Published 15-05-2018Last modified 05-08-2024
Vulnerability summary
CVE-2017-2604 is a medium (CVSS 4.3) vulnerability in jenkins. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 70% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.0 (CVE.org)EPSS score
1.30%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 15-05-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 4.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSourcesAll 3 agree
- NVDNIST4.3MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · MavenEcosystem advisory · calculated4.3MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
-0.05 pp
From 1.35% on 20-09-2026
20-09-202620-10-2026
EPSS score1.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-358Improperly Implemented Security Check for StandardThe product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
[unknown]1 product
- jenkinsjenkins 2.44 | jenkins 2.32.2
Jenkins1 product
- jenkins< 2.44 | < 2.32.2
Org.jenkins-ci.main1 product
- jenkins-core< 2.32.2 | ≥ 2.34, < 2.44
3 vendors · 3 products
References
7 links- github.com/jenkinsci/jenkins/commit/6efcf6c2ac39bc5c59ac7251822be8ddf67ceaf8X Refsource CONFIRMPatchWEB
- github.com/jenkinsci/jenkinsPACKAGE