GHSA-wf9g-rh76-6jvrMediumCVSS 5.4

Incorrect Permission Assignment for Critical Resource in Jenkins

Published
May 13, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2017-2612 →

📋 Description

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK.

🎯 Affected products2

  • maven/org.jenkins-ci.main:jenkins-core:< 2.32.2
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.34, < 2.44

🔗 References (5)