medium4.3
CVE-2017-2600
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API.
Impact
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | before 2.44 before 2.32.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/95954
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2600
- https://github.com/jenkinsci/jenkins/commit/0f92cd08a19207de2cceb6a2f4e3e9f92fdc0899
- https://jenkins.io/security/advisory/2017-02-01/
- http://www.securityfocus.com/bid/95954
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2600
- https://github.com/jenkinsci/jenkins/commit/0f92cd08a19207de2cceb6a2f4e3e9f92fdc0899
- https://jenkins.io/security/advisory/2017-02-01/