CVE-2017-1000086

HIGH

Periodic Backup Plugin - Privilege Escalation & CSRF

Title source: llm

Description

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/100437

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2017-07-10/

Scores

CVSS v3 8.0

EPSS 0.0009

EPSS Percentile 24.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-862

Status published

Products (6)

jenkins/periodic_backup 1.0

jenkins/periodic_backup 1.1

jenkins/periodic_backup 1.2

jenkins/periodic_backup 1.3

jenkins/periodic_backup 1.4

org.jenkins-ci.plugins/periodicbackup 0 - 1.5Maven

Published Oct 05, 2017

Tracked Since Feb 18, 2026