« Volver al listado

CVE-2017-2652

Estado: ModificadaAlta (8.8)—

Se ha encontrado que no se habían realizado comprobaciones de permisos en el plugin Distributed Fork en versiones anteriores a la 1.5.0 inclusive para Jenkins que proporciona el comando CLI dist-fork más allá de la comprobación básica de permisos Overall/Read, permitiendo a cualquiera con ese permiso ejecutar comandos shell arbitrarios en todos los nodos conectados.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Distributed Fork

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-2652",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "Jenkins project",
          "product": "DistFork Jenkins plugin",
          "versions": [
            {
              "status": "affected",
              "version": "<=1.5.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-07-27T20:29:00.530",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/96980",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://jenkins.io/security/advisory/2017-03-20/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/96980",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jenkins.io/security/advisory/2017-03-20/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado que no se habían realizado comprobaciones de permisos en el plugin Distributed Fork en versiones anteriores a la 1.5.0 inclusive para Jenkins que proporciona el comando CLI dist-fork más allá de la comprobación básica de permisos Overall/Read, permitiendo a cualquiera con ese permiso ejecutar comandos shell arbitrarios en todos los nodos conectados."
    }
  ],
  "lastModified": "2026-06-17T01:16:35.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:distributed_fork:*:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE3E5AD7-AEAD-447B-BE7A-C824F412CB0E",
              "versionEndIncluding": "1.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}