CVE-2017-2650

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins.

Metrics

CVSS 3.0 8.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-592

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26513.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamicallyCVE-2017-26528.8It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that proviCVE-2017-26536.5A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requesCVE-2017-26545.3jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dyCVE-2017-26586.5It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & SeCVE-2017-26597.5It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is CVE-2017-26616.1ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field wCVE-2017-26624.3A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filteCVE-2017-26637.8It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and cCVE-2017-26646.5CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portCVE-2017-26657.0The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.CVE-2017-26666.5It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conj
CVE-2017-2650: High severity, CVSS 8.5 | Vulnix