GHSA-2cm5-f78c-h2c8

    Dashboard / Vulnerabilities / GHSA-2cm5-f78c-h2c8

    GHSA-2cm5-f78c-h2c8

    Published: 13 May 2022Last Modified: 18 Feb 2024
    Aliases:
    CVE-2017-2652

    Summary: Missing permission checks in Jenkins Distributed Fork Plugin

    Details: It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-2652, https://jenkins.io/security/advisory/2017-03-20, http://www.securityfocus.com/bid/96980

    Affected packages

    Package

    Name: org.jenkins-ci.plugins:distfork

    Purl: pkg:maven/org.jenkins-ci.plugins/distfork

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.6.0

    Affected versions

    1.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-2cm5-f78c-h2c8 | CVE-DB