CVE-2017-2652 Missing permission checks in Jenkins Distributed Fork Plugin
HighCVSS 8.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/distfork(Maven) | < 1.6.0 | 1.6.0 |
| org.jenkins-ci.plugins/distfork(Maven) | = 1.2 | No fix listed |
| org.jenkins-ci.plugins/distfork(Maven) | = 1.3 | No fix listed |
| org.jenkins-ci.plugins/distfork(Maven) | = 1.4.1 | No fix listed |
| org.jenkins-ci.plugins/distfork(Maven) | = 1.5.0 | No fix listed |
| org.jenkins-ci.plugins/distfork(Maven) | <= 1.5.0 | No fix listed |
| jenkins distributed fork | <= 1.5.0 | No fix listed |
| Jenkins Project DistFork Jenkins plugin | = <=1.5.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- jenkins.io vendor-advisory
- 96980 third-party-advisory vdb-entry
- github.com