CVE-2017-2611

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

• CWE-358
• CWE-863

• http://www.securityfocus.com/bid/95956Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611Issue Tracking, Third Party Advisory
• https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86Third Party Advisory
• https://jenkins.io/security/advisory/2017-02-01/Vendor Advisory
• http://www.securityfocus.com/bid/95956Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611Issue Tracking, Third Party Advisory
• https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86Third Party Advisory
• https://jenkins.io/security/advisory/2017-02-01/Vendor Advisory

Published

May 8, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-2605Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-2606Jenkins before versions 2.44, 2.32.2 is vulnerable to an inf…4.3
• CVE-2017-2607jenkins before versions 2.44, 2.32.2 is vulnerable to a pers…4.2
• CVE-2017-2608Jenkins before versions 2.44, 2.32.2 is vulnerable to a remo…8.8
• CVE-2017-2609jenkins before versions 2.44, 2.32.2 is vulnerable to an inf…4.3
• CVE-2017-2610jenkins before versions 2.44, 2.32.2 is vulnerable to a pers…5.4
• CVE-2017-2612In Jenkins before versions 2.44, 2.32.2 low privilege users …5.4
• CVE-2017-2613jenkins before versions 2.44, 2.32.2 is vulnerable to a user…5.4
• CVE-2017-2614When updating a password in the rhvm database the ovirt-aaa-…6.8
• CVE-2017-2615Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA em…5.5
• CVE-2017-2616A race condition was found in util-linux before 2.32.1 in th…5.5
• CVE-2017-2617hawtio before version 1.5.5 is vulnerable to remote code exe…7.6