CVE-2018-1000015

Опубликовано: 23 янв. 2018

Источник: nvd

CVSS3: 4.8

CVSS2: 4.9

EPSS Низкий

Описание

On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline node blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin 2.17 and earlier.

Ссылки

https://jenkins.io/security/advisory/2018-01-22/
Vendor Advisory
https://jenkins.io/security/advisory/2018-01-22/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:pipeline_nodes_and_processes:*:*:*:*:*:jenkins:*:*

Версия до 2.17 (включая)

EPSS

Процентиль: 9%

0.00033

Низкий

4.8 Medium

CVSS3

4.9 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

CVE-2018-1000015

CVSS3: 4.2

redhat

около 8 лет назад

On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline `node` blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin 2.17 and earlier.

GHSA-9r7f-rqhw-j8h8