CVE-2017-2652

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26536.5A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST reques CVE-2017-26545.3jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dy CVE-2017-26586.5It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Se CVE-2017-26597.5It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is CVE-2017-26616.1ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field w CVE-2017-26624.3A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filte CVE-2017-26637.8It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and c CVE-2017-26646.5CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application port CVE-2017-26657.0The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.CVE-2017-26666.5It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conj CVE-2017-26678.1Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it CVE-2017-26686.5389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled.