En bref
- CVE-2017-1000398 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 63.1% des vulnérabilités.
- Correctif : mettre à jour vers 2.84, 2.73.2 ou plus récent.
Description
The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only shows information about accessible tasks.
NVD description
The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only shows information about accessible tasks.
Autres vulnérabilités de org.jenkins-ci.main:jenkins-core
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free