PT-2018-9206 · Jenkins · Jenkins Pipeline: Nodes/Processes+2

Jesse Glick · Publicado 2018-01-23 · Atualizado 2022-05-13 · CVE-2018-1000015

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Nodes and Processes plugin versions prior to 2.17

Description: The issue is related to incorrect permissions checks in the Pipeline: Nodes and Processes plugin, which allowed the execution of Pipeline node blocks on agents without the necessary Computer/Build permission. This occurred on Jenkins instances with the Authorize Project plugin.

Recommendations: For Jenkins Pipeline: Nodes and Processes plugin versions prior to 2.17, update to a version later than 2.17 to resolve the issue.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2018-1000015

GHSA-9R7F-RQHW-J8H8

Produtos afetados

Authorize Project

Jenkins

Jenkins Pipeline: Nodes/Processes

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-1000015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000015 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-01-22 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9r7f-rqhw-j8h8 · Aviso do Fabricante