CVE-2017-2650 : It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a b

It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins.

Published 2018-07-27 20:29:01

Updated 2019-10-09 23:27:01

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2017-2650

Jenkins » Pipeline Classpath Step » Version: 0.1.0 For Jenkins
cpe:2.3:a:jenkins:pipeline_classpath_step:0.1.0:*:*:*:*:jenkins:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-2650

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 43 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-2650

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P	6.8	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.5	HIGH	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H	1.8	6.0	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-2650

CWE-592

Assigned by: secalert@redhat.com (Secondary)

References for CVE-2017-2650

http://www.securityfocus.com/bid/96981

Jenkins CVE-2017-2650 Security Bypass Vulnerability
Third Party Advisory;VDB Entry
https://jenkins.io/security/advisory/2017-03-20/

Jenkins Security Advisory 2017-03-20
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2017-2650

Products affected by CVE-2017-2650

Exploit prediction scoring system (EPSS) score for CVE-2017-2650

CVSS scores for CVE-2017-2650

CWE ids for CVE-2017-2650

References for CVE-2017-2650