GitHub Advisoryadvisory · Maven

GHSA-mc22-25r3-2w9w Parameterized Trigger Plugin fails to check Item/Build permission

MEDIUM Published 2022-05-13 Modified 2022-12-06 Official page ↗
Aliases
CVE-2017-1000084
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:parameterized-trigger
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-276
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:parameterized-trigger: < 2.35.1 → fixed in 2.35.1

Description

Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins. The plugin has been adapted to now check for Item/Build permission before triggering a downstream build.

Related

Alias · CVE (1)

  • CVE-2017-1000084 Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References