CVE-2017-2652GHSA-2CM5-F78C-H2C8
It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provi
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.6.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.
Timeline
- CVE published
- Record last updated
Affected versions
- Jenkins project DistFork Jenkins plugin
through 1.5.0
- org.jenkins-ci.plugins:distforkMaven
fixed in 1.6.0