GHSA-9r7f-rqhw-j8h8

Source

https://github.com/advisories/GHSA-9r7f-rqhw-j8h8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9r7f-rqhw-j8h8/GHSA-9r7f-rqhw-j8h8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9r7f-rqhw-j8h8

Aliases

CVE-2018-1000015

Published

2022-05-13T01:18:43Z

Modified

2024-02-18T05:28:55.054342Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Incorrect permission checks in Pipeline: Nodes and Processes plugin

Details

On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline node blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin 2.17 and earlier.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T21:57:28Z",
    "nvd_published_at": "2018-01-23T14:29:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.jenkins-ci.plugins.workflow:workflow-durable-task-step

Package

Name: org.jenkins-ci.plugins.workflow:workflow-durable-task-step; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins.workflow/workflow-durable-task-step

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.18

Affected versions

0.*

0.1-beta-1

0.1-beta-2

0.1-beta-3

0.1-beta-4

0.1-beta-5

0.1-beta-6

0.1-beta-7

0.1-beta-8

1.*

1.0-beta-1

1.0

1.1

1.2

1.3

1.4

1.4.1

1.4.2

1.4.3-beta-1

1.4.3

1.5

1.6-alpha-1

1.6

1.7-alpha-1

1.7

1.8

1.9-beta-1

1.9

1.10-beta-1

1.10

1.10.1

1.11-beta-1

1.11-beta-2

1.11-beta-3

1.11-beta-4

1.11

1.12-beta-1

1.12-beta-2

1.12-beta-3

1.12

1.13

1.14-beta-1

1.14

1.14.1-beta-1

1.14.1

1.14.2

1.15-beta-1

1.15

2.*

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8

2.9

2.10

2.11

2.12

2.13

2.14

2.15

2.16

2.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9r7f-rqhw-j8h8/GHSA-9r7f-rqhw-j8h8.json"

last_known_affected_version_range

"<= 2.17"