GitHub Advisoryadvisory · Maven

GHSA-p9r2-gghq-hc57 Jenkins Multijob plugin did not check permissions in the Resume Build action

MEDIUM Published 2022-05-13 Modified 2022-12-06 Official page ↗
Aliases
CVE-2017-1000390
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:jenkins-multijob-plugin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:jenkins-multijob-plugin: < 1.26 → fixed in 1.26

Description

Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the build. Multijob plugin 1.26 introduced a permission check requiring Overall/Administer. This was lowered to Job/Build in version 1.27.

Related

Alias · CVE (1)

  • CVE-2017-1000390 Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References