GitHub Advisoryadvisory · Maven

GHSA-phf8-3qgv-rg5q Missing Authorization in Jenkins Blue Ocean Plugin

MEDIUM Published 2022-05-13 Modified 2025-01-17 Official page ↗
Aliases
CVE-2017-1000105
Ecosystem
Maven
Packages
io.jenkins.blueocean:blueocean
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2022-11-01

Affected packages

• Maven io.jenkins.blueocean:blueocean: <= 1.2.4 (no fix yet)

Description

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient. Blue Ocean now correctly checks the Run/Artifacts permission if it’s enabled before providing access to artifacts.

Related

Alias · CVE (1)

  • CVE-2017-1000105 The optional Run/Artifacts permission can be enabled by setting a Java system property. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References