CVE-2017-2652
CVE-2017-2652
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
27 Jul 2018Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.
Affected products
Jenkins project · DistFork Jenkins pluginWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →