GHSA-mrpr-vr82-x88r

Source

https://github.com/advisories/GHSA-mrpr-vr82-x88r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-mrpr-vr82-x88r/GHSA-mrpr-vr82-x88r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mrpr-vr82-x88r

Aliases

CVE-2024-52550

Published

2024-11-13T21:30:38Z

Modified

2024-11-14T16:42:29.777945Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

Details

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.

References

Affected packages

Maven / org.jenkins-ci.plugins.workflow:workflow-cps

Package

Name: org.jenkins-ci.plugins.workflow:workflow-cps; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3993.v3e20a

Affected versions

0.*

0.1-beta-1

0.1-beta-2

0.1-beta-3

0.1-beta-4

0.1-beta-5

0.1-beta-6

0.1-beta-7

0.1-beta-8

1.*

1.0-beta-1

1.0

1.1

1.2

1.3

1.4

1.4.1

1.4.2

1.4.3-beta-1

1.4.3

1.5

1.6-alpha-1

1.6

1.7-alpha-1

1.7

1.8

1.9-beta-1

1.9

1.10-beta-1

1.10

1.10.1

1.11-beta-1

1.11-beta-2

1.11-beta-3

1.11-beta-4

1.11

1.12-beta-1

1.12-beta-2

1.12-beta-3

1.12

1.13

1.14-beta-1

1.14

1.14.1-beta-1

1.14.1

1.14.2

1.15-beta-1

1.15

2.*

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8

2.9

2.10

2.11

2.12

2.13

2.14

2.15

2.16

2.17

2.18

2.19

2.20

2.21

2.22

2.23

2.24

2.25

2.26

2.27

2.28

2.29

2.30

2.30-stepstorage2-alpha

2.30-stepstorage2-alpha2

2.30-stepstorage4-beta

2.31

2.32

2.33

2.34

2.35

2.36

2.36.1

2.37

2.38

2.39

2.40

2.41

2.42

2.43

2.43-durability-beta-1

2.43-durability-beta-2

2.43-durability-beta-3

2.43-durability-beta-4

2.44

2.45

2.46

2.46.1

2.46.2

2.47

2.48

2.49

2.50

2.51

2.52

2.53

2.54

2.54.1

2.54.2

2.55

2.56

2.57

2.57.1

2.57.2

2.57.3

2.58-beta-1

2.58

2.59

2.60

2.61

2.61.1

2.61.2

2.61.3

2.62

2.63

2.64

2.65

2.66

2.66.1

2.67

2.68

2.69

2.70

2.71

2.72

2.73

2.74

2.74.1

2.75

2.76

2.77

2.78

2.79

2.80

2.81

2.82

2.83

2.84

2.85

2.86

2.87

2.88

2.89

2.90

2.91

2.92

2.92.1

2.93

2.94

2.94.1

2.94.4

2633.*

2633.v6baeedc13805

2640.*

2640.v00e79c8113de

2644.*

2644.v29a793dac95a

2646.*

2646.v6ed3b5b01ff1

2648.*

2648.va9433432b33c

2648.2651.v230593e03e9f

2656.*

2656.vf7a_e7b_75a_457

2659.*

2659.v52d3de6044d0

2660.*

2660.vb_c0412dc4e6d

2660.2664.v4c114e93f4c1

2680.*

2680.vf642ed4fa_d55

2682.*

2682.va_473dcddc941

2683.*

2683.vd0a_8f6a_1c263

2683.2687.vb_0cc3f973f06

2686.*

2686.v7c37e0578401

2687.*

2687.v3f09155513c1

2688.*

2688.v39a_b_e5c49a_65

2689.*

2689.v434009a_31b_f1

2692.*

2692.v76b_089ccd026

2705.*

2705.v0449852ee36f

2706.*

2706.v71dd22b_c5a_a_2

2710.*

2710.vcd48b_b_9e0e7d

2725.*

2725.v7b_c717eb_12ce

2729.*

2729.vea_17b_79ed57a_

2729.2732.vda_e3f07b_5a_f8

2746.*

2746.v0da_83a_332669

2746.2748.v365128b_c26d7

2759.*

2759.v87459c4eea_ca_

2759.2761.vd6e8d2a_15980

2784.*

2784.vd252824b_4eb_9

2801.*

2801.vf82a_b_b_e3e8a_5

2802.*

2802.v5ea_628154b_c2

2803.*

2803.v1a_f77ffcc773

3520.*

3520.va_8fc49e2f96f

3536.*

3536.vb_8a_6628079d5

3565.*

3565.v4b_d9b_8c29a_b_3

3581.*

3581.v2b_e4c99c76ed

3583.*

3583.v4f58de0d78d5

3601.*

3601.v9b_36a_d99e1cc

3606.*

3606.v0b_d8b_e512dcf

3611.*

3611.v201b_d9f9eb_f7

3616.*

3616.vb_2e7168f4b_0c

3618.*

3618.v13db_a_21f0fcf

3624.*

3624.v43b_a_38b_62b_b_7

3626.*

3626.v4eb_a_7d8b_2fa_4

3629.*

3629.v8177e69e359a_

3635.*

3635.vedb_8602eefa_c

3637.*

3637.v63b_c17e0ed5b_

3641.*

3641.vf58904a_b_b_5d8

3651.*

3651.ve2e99a_4f4a_e5

3653.*

3653.v07ea_433c90b_4

3659.*

3659.v582dc37621d8

3668.*

3668.v1763b_b_6ccffd

3673.*

3673.v5b_dd74276262

3691.*

3691.v28b_14c465a_b_b_

3693.*

3693.vd5c06270e4dc

3697.*

3697.vb_470e454c232

3697.3699.v9cfca_8c0db_0c

3705.*

3705.va_6a_c2775a_c17

3713.*

3713.vd671d4321509

3717.*

3717.va_180a_fe9d3cd

3722.*

3722.v85ce2a_c6240b_

3726.*

3726.v83f8cff396c9

3728.*

3728.vd5c88eef9154

3731.*

3731.ve4b_5b_857b_a_d3

3732.*

3732.vb_77c00a_57e12

3740.*

3740.v6d35b_4ed5f9f

3744.*

3744.v6f2c0fe0e54d

3767.*

3767.vdd3e0a_65b_ef3

3769.*

3769.v8b_e595e4d40d

3773.*

3773.v505e0052522c

3774.*

3774.v4a_d648d409ce

3785.*

3785.vee73da_b_9544e

3787.*

3787.v8f5dcd14a_fa_c

3791.*

3791.va_c0338ea_b_59c

3793.*

3793.v65dec41c3a_c3

3802.*

3802.vd42b_fcf00b_a_c

3805.*

3805.v769b_b_74b_db_14

3806.*

3806.va_3a_6988277b_2

3812.*

3812.vc3031a_b_a_c955

3817.*

3817.vd20b_7e2b_692b_

3821.*

3821.v9d3888c583b_1

3826.*

3826.v3b_5707fe44da_

3832.*

3832.vc43e04d6d68c

3835.*

3835.vc2a_8f9167e92

3837.*

3837.v305192405b_c0

3853.*

3853.vb_a_490d892963

3859.*

3859.v7f65cc865019

3867.*

3867.v535458ce43fd

3880.*

3880.vb_ef4b_5cfd270

3883.*

3883.vb_3ff2a_e3eea_f

3889.*

3889.v937e0b_3412d3

3894.*

3894.vd0f0248b_a_fc4

3894.3896.vca_2c931e7935

3903.*

3903.v48a_8836749e9

3908.*

3908.vd6b_b_5a_a_54010

3922.*

3922.va_f73b_7c4246b_

3943.*

3943.v3519a_3260660

3946.*

3946.v7935cb_edb_f82

3953.*

3953.v19f11da_8d2fa_

3961.*

3961.ve48ee2c44a_b_3

3964.*

3964.v0767b_4b_a_0b_fa_

3969.*

3969.vdc9d3a_efcc6a_

3975.*

3975.v567e2a_1ffa_22

3990.*

3990.vd281dd77a_388