GHSA-phf8-3qgv-rg5q

ghsaUSosv

Missing Authorization in Jenkins Blue Ocean Plugin

view advisory published 2022-05-13Licence: CC-BY-4.0

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient. Blue Ocean now correctly checks the Run/Artifacts permission if it’s enabled before providing access to artifacts.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-1000105US	medium5.3OT elevated	0.90% (59th)	—	2017-10-05
The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item…

references

External citations — patches, advisories, analysis.

https://jenkins.io/security/advisory/2017-08-07WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-1000105ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan