{"api_version":"1","generated_at":"2026-07-23T05:01:42+00:00","cve":"CVE-2017-2599","urls":{"html":"https://cve.report/CVE-2017-2599","api":"https://cve.report/api/cve/CVE-2017-2599.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-2599","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-2599"},"summary":{"title":"CVE-2017-2599","description":"Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2018-04-11 16:29:00","updated_at":"2022-11-30 21:19:00"},"problem_types":["CWE-863"],"metrics":[],"references":[{"url":"https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89","name":"https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89","refsource":"CONFIRM","tags":["Patch","Third Party Advisory"],"title":"Merge pull request #90 from jenkinsci-cert/SECURITY-321 · jenkinsci/jenkins@4ed5c85 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/95949","name":"95949","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Jenkins CVE-2017-2599 Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"],"title":"1418698 – (CVE-2017-2599) CVE-2017-2599 jenkins: Items could be created with same name as existing item (SECURITY-321)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://jenkins.io/security/advisory/2017-02-01/","name":"https://jenkins.io/security/advisory/2017-02-01/","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Jenkins Security Advisory 2017-02-01","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2599","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2599","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"2599","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jenkins","cpe5":"jenkins","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"2599","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jenkins","cpe5":"jenkins","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"2599","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jenkins","cpe5":"jenkins","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"2599","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jenkins","cpe5":"jenkins","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2017-2599","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"jenkins","version":{"version_data":[{"version_value":"jenkins 2.44"},{"version_value":" jenkins 2.32.2"}]}}]},"vendor_name":"[UNKNOWN]"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321)."}]},"impact":{"cvss":[[{"vectorString":"5.4/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.0"}]]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-863"}]}]},"references":{"reference_data":[{"name":"95949","refsource":"BID","url":"http://www.securityfocus.com/bid/95949"},{"name":"https://jenkins.io/security/advisory/2017-02-01/","refsource":"CONFIRM","url":"https://jenkins.io/security/advisory/2017-02-01/"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599"},{"name":"https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89","refsource":"CONFIRM","url":"https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89"}]}},"nvd":{"publishedDate":"2018-04-11 16:29:00","lastModifiedDate":"2022-11-30 21:19:00","problem_types":["CWE-863"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.5},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":4.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*","versionEndExcluding":"2.32.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*","versionEndExcluding":"2.44","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"2599","Ordinal":"98738","Title":"CVE-2017-2599","CVE":"CVE-2017-2599","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"2599","Ordinal":"1","NoteData":"Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).","Type":"Description","Title":null},{"CveYear":"2017","CveId":"2599","Ordinal":"2","NoteData":"2018-04-11","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"2599","Ordinal":"3","NoteData":"2020-12-04","Type":"Other","Title":"Modified"}]}}}