Описание
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
A flaw was found in Jenkins Pipeline: Declarative Plugin (pipeline-model-definition). This vulnerability allows attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved via insufficient script approval checks.
Отчет
This vulnerability is rated as Important due to the risk it poses by allowing attackers with Item/Build permissions to restart a previous build using an unapproved Jenkinsfile script, this could result in unauthorized execution of scripts, compromising the integrity of the build process.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Дополнительная информация
Статус:
EPSS
8 High
CVSS3
Связанные уязвимости
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin
EPSS
8 High
CVSS3