GitHub Advisoryadvisory · Maven

GHSA-p2qq-c693-q53w Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin

HIGH Published 2024-11-13 Modified 2024-11-14 Official page ↗
Aliases
CVE-2024-52551
Ecosystem
Maven
Packages
org.jenkinsci.plugins:pipeline-model-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-276, CWE-285
Reviewed
2024-11-14

Affected packages

• Maven org.jenkinsci.plugins:pipeline-model-parent: < 2.2218.v56d0cda → fixed in 2.2218.v56d0cda

Description

Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Declarative Plugin 2.2218.v56d0cda_37c72 refuses to restart a build whose main (Jenkinsfile) script is unapproved.

Related

Alias · CVE (1)

  • CVE-2024-52551 Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to… vulnerability

Weakness · CWE (2)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-285 Improper Authorization weakness

References