Name: CVE-2017-1000400: Missing Authorization
Creator: Rapid7
Published: 2018-01-26T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2017-1000400, CWE-862, CVSS 4.3, EPSS 0.0083

The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only lists upstream and downstream projects that the current user has access to.

CVSS Details

CVSS 3.1 Base Score: 4.3
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Jenkins 2017 10 11	—	Upgrade Jenkins LTS to version 2.73.2Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.84	Jan 26, 2018	Jan 26, 2018

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence