Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

MOYENNE 4.3CVE-2017-2600 · GHSA-wj5c-j656-h5fw · Published 15/05/2018 · updated 17/06/2026

En bref

CVE-2017-2600 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 63.6% des vulnérabilités.
Correctif : mettre à jour vers 2.44, 2.32.2 ou plus récent.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.34, < 2.44< 2.32.2`	`2.442.32.2`
jenkins jenkins	`< 2.32.2< 2.44`	`2.32.22.44`

Description

In Jenkins before versions 2.44 and 2.32.2, node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).

NVD description

In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).

References

nvd.nist.gov/vuln/detail/CVE-2017-2600 · ADVISORY
jenkinsci/jenkins commit 0f92cd0 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
jenkinsci/jenkins · PACKAGE
jenkins.io/security/advisory/2017-02-01 · WEB
securityfocus.com/bid/95954 · Third Party Advisory
jenkins.io/security/advisory/2017-02-01 · Vendor Advisory

Autres vulnérabilités de org.jenkins-ci.main:jenkins-core

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.main:jenkins-core

Maven

≥ 2.34, < 2.44< 2.32.2

2.442.32.2

jenkins

< 2.32.2< 2.44

2.32.22.44

Description

NVD description

Autres vulnérabilités de org.jenkins-ci.main:jenkins-core

Tout voir →