CVE-2017-1000502 — OS Command Injection in Jenkins EC2

CWE-78 — OS Command InjectionCWE-732 — Incorrect Permission Assignment7 documents7 sources
Severity
8.8HIGHNVD
EPSS
0.7%
top 28.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins EC2
Timeline
PublishedJan 24
Latest updateMay 14

Description

Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of these agents now requires the 'Run Scripts' permission typically only granted to administrators.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDjenkins/ec21.37

🔴Vulnerability Details

3
OSV
Arbitrary shell command execution in Jenkins EC2 Plugin↗2022-05-14
▶
GHSA
Arbitrary shell command execution in Jenkins EC2 Plugin↗2022-05-14
▶
CVEList
CVE-2017-1000502: Users with permission to create or configure agents in Jenkins 1↗2018-01-24
▶

📋Vendor Advisories

2
Red Hat
jenkins: Users with agent related permissions in EC2 Plugin are able to run arbitrary shell commands on master node↗2018-01-24
▶
Jenkins
Jenkins Security Advisory 2017-12-06↗2017-12-06
▶

💬Community

1
Bugzilla
CVE-2017-1000502 jenkins: Users with agent related permissions in EC2 Plugin are able to run arbitrary shell commands on master node↗2018-01-29
▶
CVE-2017-1000502 — OS Command Injection in Jenkins EC2 | cvebase