CVE-2017-2613

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-770 CWE-352

Affected software

Vendor	Product	Versions
[UNKNOWN]	jenkins	jenkins 2.44; jenkins 2.32.2

References

http://www.securityfocus.com/bid/95967Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613Issue Tracking
https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601Patch
https://jenkins.io/security/advisory/2017-02-01/Vendor Advisory
http://www.securityfocus.com/bid/95967Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613Issue Tracking
https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601Patch
https://jenkins.io/security/advisory/2017-02-01/Vendor Advisory

Timeline

Published: May 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26146.3When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if CVE-2017-26159.1Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur wh CVE-2017-26164.7A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attack CVE-2017-26177.8hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a cra CVE-2017-26185.5A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write CVE-2017-26197.5Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the serv CVE-2017-26209.9Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The is CVE-2017-26215.5An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory w CVE-2017-26225.5An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable CVE-2017-26235.3It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering.CVE-2017-26247.0It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. CVE-2017-26255.5It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a loc