CVE-2017-1000401

The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for <f:password/> is now always sent via POST, which is typically not logged.

CVSS v3 2.2 LOW
CVSS v2.0 1.2 LOW

2.2^/10

CVSS v3 : LOW

Vector : AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.2^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 1.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://jenkins.io/security/advisory/2017-10-11/	Vendor Advisory
https://jenkins.io/security/advisory/2017-10-11/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jenkins:jenkins:::::lts:::*
	cpe:2.3:a:jenkins:jenkins:::::-:::*

History

21 Nov 2024, 03:04

Type	Values Removed	Values Added
References	~~() https://jenkins.io/security/advisory/2017-10-11/ - Vendor Advisory~~	() https://jenkins.io/security/advisory/2017-10-11/ - Vendor Advisory

Information

Published : 2018-01-26 02:29

Updated : 2024-11-21 03:04

NVD link : CVE-2017-1000401

Mitre link : CVE-2017-1000401

CVE.ORG link : CVE-2017-1000401

JSON object : View

Products Affected

jenkins

jenkins

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2017-1000401", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 1.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.8}]}, "published": "2018-01-26T02:29:01.203", "references": [{"url": "https://jenkins.io/security/advisory/2017-10-11/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://jenkins.io/security/advisory/2017-10-11/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for <f:password/> is now always sent via POST, which is typically not logged."}, {"lang": "es", "value": "El control de formularios por defecto en Jenkins 2.73.1 y anteriores y 2.83 y anteriores para contrase\u00f1as y otros secretos, , es compatible con validaci\u00f3n de formularios (por ejemplo, para claves API). Las peticiones AJAX de validaci\u00f3n de formularios se enviaron mediante GET, lo que podr\u00eda resultar en que los secretos se registren en un log de acceso HTTP en configuraciones que no son por defecto de Jenkins y se pongan a disposici\u00f3n de usuarios con acceso a estos archivos de registro. La validaci\u00f3n de formulario para se env\u00eda ahora siempre mediante POST, que no suele registrarse."}], "lastModified": "2024-11-21T03:04:38.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "90FE7614-BB3D-45D2-B287-A9F97D437D61", "versionEndIncluding": "2.73.1"}, {"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "D29188BE-532C-4AF8-B5AC-95CC0197B452", "versionEndIncluding": "2.83"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}