Skip to content

Incorrect Authorization in Jenkins

Moderate severity GitHub Reviewed Published May 13, 2022 to the GitHub Advisory Database • Updated Dec 21, 2023

Package

maven org.jenkins-ci.main:jenkins-core (Maven)

Affected versions

< 2.121.2
>= 2.122, < 2.132

Patched versions

2.121.2
2.132

Description

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.

References

Published by the National Vulnerability Database Jul 23, 2018
Published to the GitHub Advisory Database May 13, 2022
Reviewed Jun 28, 2022
Last updated Dec 21, 2023

Severity

Moderate
4.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CVE ID

CVE-2018-1999004

GHSA ID

GHSA-wmr8-25ff-ggpj

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.