What’s Vulnerable › Vulnerabilities

CVE-2017-2611

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-08 · updated 2026-06-17
• Weakness: CWE-358

Description

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

Affected products

• Jenkins: before 2.32.2; before 2.44 — fixed in 2.32.2, 2.44
• Openshift: 2.0, 3.0

How to fix

Upgrade to a fixed version: Jenkins 2.32.2, 2.44. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/95956
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611
• https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86
• https://jenkins.io/security/advisory/2017-02-01/
• http://www.securityfocus.com/bid/95956
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611
• https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86
• https://jenkins.io/security/advisory/2017-02-01/

Get alerted when CVE-2017-2611 or the next vulnerability affects your stack