CVE-2017-1000391 | BDVDB-2026-95802 Detail

Description#

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/101773
https://jenkins.io/security/advisory/2017-11-08/

Exploit#

No public exploit known

History#

Version 12018-01-26Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.