GHSA-8jx9-7j5m-79x4

ghsaUSosv

Jenkins Build Step Plugin fails to check Item/Build permission

view advisory published 2022-05-13Licence: CC-BY-4.0

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-1000089US	medium5.3OT elevated	0.96% (61st)	—	2017-10-05
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin…

references

External citations — patches, advisories, analysis.

https://jenkins.io/security/advisory/2017-07-10WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-1000089ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan