CVE-2017-1000391

Published: Jan 26, 2018Modified: Nov 21, 2024

7.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Exploitability: 2.1 / Impact: 5.2

Source: NVD

Description

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.

Affected (2)

Products: Jenkins: Jenkins

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Jenkins Jenkins	Up to 2.88
Jenkins Jenkins	Up to 2.73.2

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.securityfocus.com/bid/101773

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://jenkins.io/security/advisory/2017-11-08/

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/101773

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://jenkins.io/security/advisory/2017-11-08/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.