CVE-2017-1000395

2018-01-2600:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

32.8%

JSON

Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about
Jenkins user accounts which is generally available to anyone with
Overall/Read permissions via the /user/(username)/api remote API. This
included e.g. Jenkins users’ email addresses if the Mailer Plugin is
installed. The remote API now no longer includes information beyond the
most basic (user ID and name) unless the user requesting it is a Jenkins
administrator.