What is GHSA-7r4h-2h23-6jq9?

GHSA-7r4h-2h23-6jq9 is a security advisory published by GitHub Security Advisories with Medium severity. Incorrect Authorization in Jenkins

Which CVE IDs does GHSA-7r4h-2h23-6jq9 cover?

GHSA-7r4h-2h23-6jq9 covers the following CVE IDs: CVE-2017-2599. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7r4h-2h23-6jq9?

GHSA-7r4h-2h23-6jq9 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-7r4h-2h23-6jq9?

GHSA-7r4h-2h23-6jq9 affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003c= 2.32.1; maven/org.jenkins-ci.main:jenkins-core:\u003e= 2.34, \u003c= 2.43.

GHSA-7r4h-2h23-6jq9MediumCVSS 5.4

Incorrect Authorization in Jenkins

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2017-2599 →

📋 Description

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:<= 2.32.1
maven/org.jenkins-ci.main:jenkins-core:>= 2.34, <= 2.43

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-2599
https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599
https://jenkins.io/security/advisory/2017-02-01/
https://github.com/advisories/GHSA-7r4h-2h23-6jq9