En bref
- CVE-2017-1000400 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.83%, plus élevée que 57.6% des vulnérabilités.
- Correctif : mettre à jour vers 2.84, 2.73.2 ou plus récent.
Description
The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only lists upstream and downstream projects that the current user has access to.
NVD description
The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only lists upstream and downstream projects that the current user has access to.
Autres vulnérabilités de org.jenkins-ci.main:jenkins-core
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free