CVE-2017-1000110

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-1000110
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000110.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-1000110
Aliases
Published
2017-10-05T01:29:04Z
Modified
2024-09-03T01:33:49.826603Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when configuring existing GitHub organization folders. This allowed users with read access to the GitHub organization folder to reconfigure it, including changing the GitHub API endpoint for the organization folder to an attacker-controlled server to obtain the GitHub access token, if the organization folder was initially created using Blue Ocean.

References

Affected packages

Git / github.com/jenkinsci/blueocean-plugin

Affected ranges

Type
GIT
Repo
https://github.com/jenkinsci/blueocean-plugin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
01baca3346fe7e67009b22a2288af34c97cf10f8
Last affected
2c8a6aa5acf8e973b4080b270883647878cb2531
Last affected
b6c3da9d74d81b6d80e096f8da66c713dbe0d806
Last affected
e339ce0fbdebf7e02dab422cb6cf1643b3a1979b

Affected versions

blueocean-parent-1.*

blueocean-parent-1.0-alpha-1
blueocean-parent-1.0-alpha-2
blueocean-parent-1.0-alpha-3
blueocean-parent-1.0-alpha-4
blueocean-parent-1.0-alpha-5
blueocean-parent-1.0-alpha-6
blueocean-parent-1.0-alpha-7
blueocean-parent-1.0-alpha-8
blueocean-parent-1.0-alpha-9
blueocean-parent-1.0.0-b01
blueocean-parent-1.0.0-b02
blueocean-parent-1.0.0-b03
blueocean-parent-1.0.0-b04
blueocean-parent-1.0.0-b05
blueocean-parent-1.0.0-b06
blueocean-parent-1.0.0-b07
blueocean-parent-1.0.0-b08
blueocean-parent-1.0.0-b09
blueocean-parent-1.0.0-b10
blueocean-parent-1.0.0-b11
blueocean-parent-1.0.0-b12
blueocean-parent-1.0.0-b13
blueocean-parent-1.0.0-b14
blueocean-parent-1.0.0-b15
blueocean-parent-1.0.0-b16
blueocean-parent-1.0.0-b17
blueocean-parent-1.0.0-b18
blueocean-parent-1.0.0-b19
blueocean-parent-1.0.0-b20
blueocean-parent-1.0.0-b21
blueocean-parent-1.0.0-b22
blueocean-parent-1.0.0-b23
blueocean-parent-1.0.0-b24
blueocean-parent-1.0.0-b25
blueocean-parent-1.0.0-rc1
blueocean-parent-1.0.0-rc2
blueocean-parent-1.0.0-rc3
blueocean-parent-1.1.0
blueocean-parent-1.1.0-beta-1
blueocean-parent-1.1.0-beta-2
blueocean-parent-1.1.0-beta-3
blueocean-parent-1.1.0-beta-4
blueocean-parent-1.1.0-beta-5
blueocean-parent-1.1.0-beta-6
blueocean-parent-1.1.0-beta-7
blueocean-parent-1.1.0-beta-8
blueocean-parent-1.1.0-beta-9
blueocean-parent-1.1.1
blueocean-parent-1.1.2
blueocean-parent-1.1.3
blueocean-parent-1.1.4
blueocean-parent-1.1.5
blueocean-parent-1.2.0-beta-1