Authentication Bypass Affecting org.jenkins-ci.main:jenkins-core package, versions [,2.46.2) [2.50,2.57)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-32181
- published 9 Apr 2018
- disclosed 14 Mar 2017
- credit Jesse Glick
Introduced: 14 Mar 2017
CVE-2017-1000354 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to versions 2.46.2, 2.57 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open-source automation server.
Affected versions of this package are vulnerable to Authentication Bypass. The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance.