Persisted Cross-Site Scripting Vulnerability in Jenkins by CloudBees
CVE-2017-2601

6.1MEDIUM

Key Information:

Vendor

Unspecified

Status
Jenkins
Vendor
CVE Published:
10 May 2018

What is CVE-2017-2601?

Jenkins, a widely used open-source automation server, is susceptible to a persisted cross-site scripting (XSS) vulnerability. This issue allows authenticated users with job configuration permissions to inject malicious JavaScript into parameter names and descriptions. If exploited, this vulnerability can lead to unauthorized data access or manipulation, posing significant risks to users and their environments.

Affected Version(s)

jenkins jenkins 2.44

jenkins jenkins 2.32.2

References

https://jenkins.io/security/advisory/2017-02-01/
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2601
http://www.securityfocus.com/bid/95960
vdb-entry

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.