CVE-2017-1000086

CVE-2017-1000086 describes a critical vulnerability in the Jenkins Periodic Backup Plugin, affecting versions of the plugin. The flaw allowed any user with basic read access to manipulate backup settings, trigger, restore, and download backups, and even delete existing backups due to a lack of permission checks. Furthermore, the plugin was susceptible to Cross-Site Request Forgery (CSRF) attacks as it did not enforce POST requests for its API. Rated with a CVSS score of 8.0 (High), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. An attacker could remotely exploit this by tricking a logged-in user into performing an unintended action. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or active threat intelligence surrounding it.