CVE-2017-1000086

Severity: high (CVSS 8.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-05 · updated 2026-06-17
Weakness: CWE-862

Description

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

Affected products

Jenkins Periodic Backup: 1.0, 1.1, 1.2, 1.3, 1.4

References

http://www.securityfocus.com/bid/100437
https://jenkins.io/security/advisory/2017-07-10/
http://www.securityfocus.com/bid/100437
https://jenkins.io/security/advisory/2017-07-10/

Get alerted when CVE-2017-1000086 or the next vulnerability affects your stack