cve.bz

CVE-2017-1000090

8.8 highEPSS 0.7%

High (8.8) in jenkins role-based authorization strategy. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.plugins:role-strategy 2.5.1.

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.

Severity

CVSS 3.0

8.8 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE
CWE-352
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-774g-r3fm-4v85Mavenorg.jenkins-ci.plugins:role-strategy<2.5.12.5.1

References

Check your stackJSON