It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/96980 | third party advisory vdb entry |
| https://jenkins.io/security/advisory/2017-03-20/ | vendor advisory |