CVE-2017-1000086
First published: Wed Oct 04 2017(Updated: )
The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Periodic Backup | =1.0 | |
| Jenkins Periodic Backup | =1.1 | |
| Jenkins Periodic Backup | =1.2 | |
| Jenkins Periodic Backup | =1.3 | |
| Jenkins Periodic Backup | =1.4 | |
| maven/org.jenkins-ci.plugins:periodicbackup | <=1.4 | 1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5293-3fgp-cr3x
- alias/CVE-2017-1000086
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins periodic backup
- version/jenkins periodic backup/1.0
- version/jenkins periodic backup/1.1
- version/jenkins periodic backup/1.2
- version/jenkins periodic backup/1.3
- version/jenkins periodic backup/1.4
- package-manager/maven