CVE-2017-2611: Medium severity jenkins lts vulnerability
Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2611?
CVE-2017-2611 is considered a medium severity vulnerability due to insufficient permission checks.
How do I fix CVE-2017-2611?
To fix CVE-2017-2611, update Jenkins to version 2.32.3 or later, or version 2.45 or later.
What are the affected versions for CVE-2017-2611?
CVE-2017-2611 affects Jenkins versions before 2.32.3 and 2.44, as well as certain versions of Red Hat OpenShift.
Who is impacted by CVE-2017-2611?
Users with read access to Jenkins are impacted by CVE-2017-2611 as they can trigger unauthorized background processes.
What functionality is affected by CVE-2017-2611?
CVE-2017-2611 specifically affects the functionality of the /workspaceCleanup and /fingerprintCleanup URLs in Jenkins.