Incorrect authorization in jenkins
Priority LOW 24CWE-358Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.
Why it matters now
EPSS 0.01935 80th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.44Red Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| unspecified | jenkins | jenkins 2.44; jenkins 2.32.2 | — | No fix listed | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 2.44 | 2.44 | Patch available | GHSA-3297-944x-j7x7 |
- jenkins Vendorunspecified Affected jenkins 2.44; jenkins 2.32.2 Fixed in — No fix listed CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.44 Fixed in 2.44 Patch available GHSA-3297-944x-j7x7
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* | before 2.32.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* | before 2.44 | Vulnerable | Jenkins |
| cpe:2.3:a:redhat:openshift:2.0:*:*:*:enterprise:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:* | 3.0 | Vulnerable | Red Hat |
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions before 2.32.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions before 2.44 Vulnerable ·Jenkins
- cpe:2.3:a:redhat:openshift:2.0:*:*:*:enterprise:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:* Versions 3.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-3297-944x-j7x7 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.44 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 2 | Affected | — |
| Red Hat OpenShift Enterprise 3 | Affected | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2611
- 2026-10-03 Alias added: GHSA-3297-944x-j7x7
References
Sources
- CVE-2017-2611 · CVE Program
- CVE-2017-2611 · NVD
- FIRST EPSS
- GHSA-3297-944x-j7x7 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-2611 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences