VULNERABILITY INTELLIGENCE

CVE-2017-2611

CVSS score4.3 MEDIUM
EPSS probability1.93%
CISA KEVNot currently listed
Published2018-05-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Description

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

Weakness classification

  • CWE-358: Improperly Implemented Security Check for Standard
  • CWE-863: Incorrect Authorization

Primary references