Vulnerability Details : CVE-2017-2602

jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
Published 2018-05-15 21:29:00
Updated 2019-10-09 23:26:55
Source Red Hat, Inc.
View at NVD,   CVE.org

Products affected by CVE-2017-2602

Threat overview for CVE-2017-2602

Top countries where our scanners detected CVE-2017-2602
Top open port discovered on systems with this issue 80
IPs affected by CVE-2017-2602 3,121
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2017-2602!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2017-2602

EPSS FAQ
0.10%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 41 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-2602

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
4.0
 MEDIUM AV:N/AC:L/Au:S/C:N/I:P/A:N
8.0
2.9
 NIST
4.3
 MEDIUM CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
2.8
1.4
 NIST
3.1
 LOW CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1.6
1.4
 Red Hat, Inc.

CWE ids for CVE-2017-2602

  • The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
    Assigned by: secalert@redhat.com (Secondary)

References for CVE-2017-2602

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close