CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2607
https://notcve.org/view.php?id=CVE-2017-2607
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs. Jenkins en versiones anteriores a la 2.44, 2.32.2 es vulnerable a Cross-Site Scripting (XSS) persistente en las notas de la consola (SECURITY-382). Jenkins permite que los plugins anoten registros de build, añadiendo nuevo contenido o cambiando la presentación del contenido ya existente mientras se ejecuta la build. • http://www.securityfocus.com/bid/95963 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2607 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2613
https://notcve.org/view.php?id=CVE-2017-2613
jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406). Jenkins en versiones anteriores a la 2.44 y 2.32.2 es vulnerable a Cross-Site Request Forgery (CSRF) de creación de usuarios mediante el uso de GET por parte de los administradores. Aunque este registro de usuarios solo se retiene hasta el reinicio en la mayoría de casos, los navegadores web de los administradores se podrían manipular para crear un gran número de registros de usuario (SECURITY-406). • http://www.securityfocus.com/bid/95967 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613 https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601 https://jenkins.io/security/advisory/2017-02-01 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2610
https://notcve.org/view.php?id=CVE-2017-2610
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388). Jenkins en versiones anteriores a la 2.44 y 2.32.2 es vulnerable a Cross-Site Scripting (XSS) persistente en las sugerencias de búsqueda debido al escapado incorrecto de usuarios con los caracteres "menor que" y "mayor que" en sus nombres (SECURITY-388). • http://www.securityfocus.com/bid/95951 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2610 https://github.com/jenkinsci/jenkins/commit/307ed31caba68a46426b8c73a787a05add2c7489 https://jenkins.io/security/advisory/2017-02-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2603
https://notcve.org/view.php?id=CVE-2017-2603
Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362). Jenkins en versiones anteriores a la 2.44 y 2.32.2 es vulnerable a una fuga de datos de usuario en la API config.xml de los agentes desconectados. Esto podría filtrar datos sensibles como tokens de API (SECURITY-362). • http://www.securityfocus.com/bid/95955 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2603 https://github.com/jenkinsci/jenkins/commit/3cd946cbef82c6da5ccccf3890d0ae4e091c4265 https://jenkins.io/security/advisory/2017-02-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-325: Missing Cryptographic Step •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2604
https://notcve.org/view.php?id=CVE-2017-2604
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371). En Jenkins en versiones anteriores a la 2.44 y 2.32.2, los usuarios de privilegios bajos podían realizar acciones en los monitores administrativos debido a que no estaban protegidos de forma consistente por controles de permisos (SECURITY-371). • http://www.securityfocus.com/bid/95959 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2604 https://github.com/jenkinsci/jenkins/commit/6efcf6c2ac39bc5c59ac7251822be8ddf67ceaf8 https://jenkins.io/security/advisory/2017-02-01 • CWE-287: Improper Authentication CWE-358: Improperly Implemented Security Check for Standard •