PT-2018-5172 · Jenkins · Jenkins Multijob Plugin+1

Lars Hupel · Published 2018-01-26 · Updated 2022-05-13 · CVE-2017-1000390

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Multijob plugin versions 1.25 and earlier

Description The issue concerns a permission check in the Resume Build action. Specifically, it allows anyone with Job/Read permission to resume the build without proper authorization. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details include the lack of permission checks in the Resume Build action, allowing unauthorized access with Job/Read permission.

Recommendations For Jenkins Multijob plugin versions 1.25 and earlier, update to version 1.27 or later to introduce a permission check requiring Job/Build. As a temporary workaround, consider restricting access to the Resume Build action to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2017-1000390

GHSA-P9R2-GGHQ-HC57

Affected Products

Jenkins

Jenkins Multijob Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000390 · Security Note
• https://jenkins.io/security/advisory/2017-10-23 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9r2-gghq-hc57 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000390 · Vendor Advisory
• http://securityfocus.com/bid/102824 · Note