5.4
Moyenne
CVE-2017-2613 jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins
Description
jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| jenkins | Versions non publiées |
Références
- jenkins.io jenkins.io
- github.com github.com
- bugzilla.redhat.com bugzilla.redhat.com
- 95967 www.securityfocus.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de jenkins
Les 12 CVE de jenkins →
CVE-2017-2598
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes…
4.3
Moyenne
CVE-2017-2609
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions…
4.3
Moyenne
CVE-2017-2607
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes…
4.2
Moyenne
CVE-2017-2602
jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the…
3.1
Faible