CVE-2017-2652
Last modified
CVE-2017-2652 is a vulnerability of currently unknown severity. It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.. EPSS estimates a 1.42% chance of exploitation in the next 30 days.
Description
It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Distributed Fork | <= 1.5.0 |
References
- http://www.securityfocus.com/bid/96980Third Party Advisory, VDB Entry
- https://jenkins.io/security/advisory/2017-03-20/Vendor Advisory
- http://www.securityfocus.com/bid/96980Third Party Advisory, VDB Entry
- https://jenkins.io/security/advisory/2017-03-20/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-2652?
How severe is CVE-2017-2652?
How do I fix CVE-2017-2652?
Are you affected by CVE-2017-2652?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST