CVE-2017-2601mediumCWE-79

CVE-2017-2601: falha de média gravidade em jenkins

Publicada em 10 mai 2018 · Atualizada em 05 ago 2024

Seguir esta CVE + Monitorar Jenkins + Monitorar org.jenkins-ci.main:jenkins-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 2.0%

Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Produtos afetados

unspecified · jenkins

CVEs relacionadas — jenkins

No mesmo produto, das mais perigosas para as menos.

CVE-2017-2611MEDIUMCVE-2017-2611EPSS 1.9%CVE-2017-2606MEDIUMCVE-2017-2606EPSS 1.8%

Referências

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2601 https://github.com/jenkinsci/jenkins/commit/fd2e081b947124c90bcd97bfc55e1a7f2ef41a74 https://jenkins.io/security/advisory/2017-02-01/http://www.openwall.com/lists/oss-security/2022/04/12/5 http://www.openwall.com/lists/oss-security/2022/05/17/8 http://www.openwall.com/lists/oss-security/2022/06/22/3 http://www.openwall.com/lists/oss-security/2022/06/30/3 http://www.openwall.com/lists/oss-security/2022/10/19/3 http://www.securityfocus.com/bid/95960