Lucene search

[email protected]CVE-2017-1000086

HistoryOct 05, 2017 - 1:29 a.m.

CVE-2017-1000086

2017-10-0501:29:03

CWE-862

[email protected]

web.nvd.nist.gov

periodic backup plugin

permission checks

overall/read access

settings

trigger backups

restore backups

download backups

delete backups

log rotation

api

cross-site request forgery

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.4%

JSON

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

Affected configurations

NVD

Node

jenkinsperiodic_backupMatch1.0jenkins

jenkinsperiodic_backupMatch1.1jenkins

jenkinsperiodic_backupMatch1.2jenkins

jenkinsperiodic_backupMatch1.3jenkins

jenkinsperiodic_backupMatch1.4jenkins

CPENameOperatorVersion
jenkins:periodic_backupjenkins periodic backupeq1.0
jenkins:periodic_backupjenkins periodic backupeq1.1
jenkins:periodic_backupjenkins periodic backupeq1.2
jenkins:periodic_backupjenkins periodic backupeq1.3
jenkins:periodic_backupjenkins periodic backupeq1.4

CPE	Name	Operator	Version
jenkins:periodic_backup	jenkins periodic backup	eq	1.0
jenkins:periodic_backup	jenkins periodic backup	eq	1.1
jenkins:periodic_backup	jenkins periodic backup	eq	1.2
jenkins:periodic_backup	jenkins periodic backup	eq	1.3
jenkins:periodic_backup	jenkins periodic backup	eq	1.4

References

www.securityfocus.com/bid/100437

jenkins.io/security/advisory/2017-07-10/

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.4%

JSON

Related for CVE-2017-1000086

cvelist1 osv2 nvd1 prion1 github1