GHSA-2cm5-f78c-h2c8

Source

https://github.com/advisories/GHSA-2cm5-f78c-h2c8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2cm5-f78c-h2c8/GHSA-2cm5-f78c-h2c8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2cm5-f78c-h2c8

Aliases

CVE-2017-2652

Published

2022-05-13T01:36:51Z

Modified

2024-02-18T05:23:00.703274Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Missing permission checks in Jenkins Distributed Fork Plugin

Details

It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.

Database specific

{
    "nvd_published_at": "2018-07-27T20:29:00Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T22:19:19Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:distfork

Package

Name: org.jenkins-ci.plugins:distfork; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/distfork

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.0

Affected versions

1.*

1.2

1.3

1.4.1

1.5.0

Database specific

{
    "last_known_affected_version_range": "<= 1.5.0"
}