Vulnerability Details : CVE-2017-1000399
The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API endpoint is now only available for tasks that the current user has access to.
Vulnerability category: Information leak
Threat overview for CVE-2017-1000399
Top countries where our scanners detected CVE-2017-1000399
Top open port discovered on systems with this issue
80
IPs affected by CVE-2017-1000399 2,989
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-1000399!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-1000399
Probability of exploitation activity in the next 30 days: 0.05%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 20 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-1000399
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST |
4.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2017-1000399
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-1000399
-
https://jenkins.io/security/advisory/2017-10-11/
Jenkins Security Advisory 2017-10-11Vendor Advisory
Products affected by CVE-2017-1000399
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*