Описание
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.
A flaw was found in the Jenkins Pipeline: Groovy Plugin (jenkins-plugin/workflow-cps). This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main (Jenkinsfile) script is no longer approved, bypassing script approval checks via the rebuild action.
Отчет
This vulnerability is considered of important severity rather than moderate because it allows attackers with the Item/Build permission to trigger the execution of previously unapproved Jenkinsfiles during the rebuild process. Jenkinsfiles often contain critical pipeline scripts that can interact with sensitive systems and data, including environment variables, credentials, and system configurations. If these scripts are not properly approved, malicious or unauthorized code could be executed, potentially leading to arbitrary code execution, privilege escalation, or data manipulation. The lack of a re-approval check for rebuilt builds bypasses essential security controls, which can be exploited by attackers to gain unauthorized access or compromise the integrity of the build process.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Дополнительная информация
Статус:
8 High
CVSS3
Связанные уязвимости
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
8 High
CVSS3