CVE-2017-2604

2018-05-1521:29:00

Google

osv.dev

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

5 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

41.9%

JSON

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).

CPENameOperatorVersion
jenkinseqbuilds/154
jenkinseqchanges/215
jenkinseqchanges/273
jenkinseqbuilds/17
jenkinseqbuilds/11
jenkinseqjenkins-1.509
jenkinseqbuilds/164
jenkinseqjenkins-1.550
jenkinseqbuilds/176
jenkinseqbuilds/311

Name	Operator	Version
jenkins	eq	builds/154
jenkins	eq	changes/215
jenkins	eq	changes/273
jenkins	eq	builds/17
jenkins	eq	builds/11
jenkins	eq	jenkins-1.509
jenkins	eq	builds/164
jenkins	eq	jenkins-1.550
jenkins	eq	builds/176
jenkins	eq	builds/311