jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
| Link | Tags |
|---|---|
| https://jenkins.io/security/advisory/2017-02-01/ | vendor advisory |
| https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601 | patch |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613 | issue tracking |
| http://www.securityfocus.com/bid/95967 | vdb entry third party advisory |