« Volver al listado

CVE-2017-1000393

Estado: ModificadaAlta (8.8)—

Los usuarios de Jenkins 2.73.1 y anteriores y 2.83 y anteriores con permiso para crear o configurar agentes podrían configurar un método de inicio llamado "Launch agent via execution of command on master". Esto les permitía ejecutar comandos shell arbitrarios en el nodo del servidor maestro cada vez que se supone que se iba a iniciar el agente. Ahora, la configuración de este método de inicio requiere el permiso "Run Scripts" que, normalmente, solo se otorga a los administradores.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Jenkins

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1000393",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-01-26T02:29:00.673",
  "references": [
    {
      "url": "https://jenkins.io/security/advisory/2017-10-11/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://jenkins.io/security/advisory/2017-10-11/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of this launch method now requires the Run Scripts permission typically only granted to administrators."
    },
    {
      "lang": "es",
      "value": "Los usuarios de Jenkins 2.73.1 y anteriores y 2.83 y anteriores con permiso para crear o configurar agentes podrían configurar un método de inicio llamado \"Launch agent via execution of command on master\". Esto les permitía ejecutar comandos shell arbitrarios en el nodo del servidor maestro cada vez que se supone que se iba a iniciar el agente. Ahora, la configuración de este método de inicio requiere el permiso \"Run Scripts\" que, normalmente, solo se otorga a los administradores."
    }
  ],
  "lastModified": "2026-06-17T00:59:05.510",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90FE7614-BB3D-45D2-B287-A9F97D437D61",
              "versionEndIncluding": "2.73.1"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D29188BE-532C-4AF8-B5AC-95CC0197B452",
              "versionEndIncluding": "2.83"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}