CVE Vulnerabilities

CVE-2017-2602

Incomplete List of Disallowed Inputs

Published: May 15, 2018 | Modified: Nov 21, 2024
CVSS 3.x
4.3
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N
RedHat/V2
RedHat/V3
3.1 LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Ubuntu
MEDIUM

jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).

Weakness

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

Affected Software

Name Vendor Start Version End Version
Jenkins Jenkins * 2.32.2 (excluding)
Jenkins Jenkins * 2.44 (excluding)
Jenkins Ubuntu precise *
Jenkins Ubuntu upstream *

Potential Mitigations

References