PT-2018-9206 · Jenkins · Jenkins Pipeline: Nodes/Processes+2

Jesse Glick · Published 2018-01-23 · Updated 2022-05-13 · CVE-2018-1000015

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Nodes and Processes plugin versions prior to 2.17

Description: The issue is related to incorrect permissions checks in the Pipeline: Nodes and Processes plugin, which allowed the execution of Pipeline node blocks on agents without the necessary Computer/Build permission. This occurred on Jenkins instances with the Authorize Project plugin.

Recommendations: For Jenkins Pipeline: Nodes and Processes plugin versions prior to 2.17, update to a version later than 2.17 to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2018-1000015

GHSA-9R7F-RQHW-J8H8

Affected Products

Authorize Project

Jenkins

Jenkins Pipeline: Nodes/Processes

References · 4

• https://osv.dev/vulnerability/CVE-2018-1000015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000015 · Security Note
• https://jenkins.io/security/advisory/2018-01-22 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9r7f-rqhw-j8h8 · Vendor Advisory