CVE-2017-1000388

MEDIUM

Jenkins Dependency Graph Viewer <0.12 - Privilege Escalation

Title source: llm

Description

Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2017-10-23/

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 9.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-862

Status published

Products (2)

jenkins/dependency_graph_viewer < 0.12

org.jenkins-ci.plugins/depgraph-view 0 - 0.13Maven

Published Jan 26, 2018

Tracked Since Feb 18, 2026