CVE-2017-1000084

Published: Oct 5, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

Affected (42)

Products: Jenkins: Parameterized Trigger

Jenkins

1 product

Parameterized Trigger

Configuration A

42 vulnerable

Vulnerable Software	Affected Versions
Jenkins Parameterized Trigger	Version 1.0
Jenkins Parameterized Trigger	Version 1.1
Jenkins Parameterized Trigger	Version 1.2
Jenkins Parameterized Trigger	Version 1.3
Jenkins Parameterized Trigger	Version 1.4
Jenkins Parameterized Trigger	Version 1.5
Jenkins Parameterized Trigger	Version 1.6
Jenkins Parameterized Trigger	Version 2.0
Jenkins Parameterized Trigger	Version 2.10
Jenkins Parameterized Trigger	Version 2.11
Jenkins Parameterized Trigger	Version 2.12
Jenkins Parameterized Trigger	Version 2.13
Jenkins Parameterized Trigger	Version 2.14
Jenkins Parameterized Trigger	Version 2.15
Jenkins Parameterized Trigger	Version 2.16
Jenkins Parameterized Trigger	Version 2.17
Jenkins Parameterized Trigger	Version 2.18
Jenkins Parameterized Trigger	Version 2.19
Jenkins Parameterized Trigger	Version 2.1
Jenkins Parameterized Trigger	Version 2.20
Jenkins Parameterized Trigger	Version 2.21
Jenkins Parameterized Trigger	Version 2.22
Jenkins Parameterized Trigger	Version 2.23
Jenkins Parameterized Trigger	Version 2.24
Jenkins Parameterized Trigger	Version 2.25
Jenkins Parameterized Trigger	Version 2.26
Jenkins Parameterized Trigger	Version 2.27
Jenkins Parameterized Trigger	Version 2.28
Jenkins Parameterized Trigger	Version 2.29
Jenkins Parameterized Trigger	Version 2.2
Jenkins Parameterized Trigger	Version 2.30
Jenkins Parameterized Trigger	Version 2.31
Jenkins Parameterized Trigger	Version 2.32
Jenkins Parameterized Trigger	Version 2.33
Jenkins Parameterized Trigger	Version 2.34
Jenkins Parameterized Trigger	Version 2.3
Jenkins Parameterized Trigger	Version 2.4
Jenkins Parameterized Trigger	Version 2.5
Jenkins Parameterized Trigger	Version 2.6
Jenkins Parameterized Trigger	Version 2.7
Jenkins Parameterized Trigger	Version 2.8
Jenkins Parameterized Trigger	Version 2.9

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (2)

https://jenkins.io/security/advisory/2017-07-10/

Source: cve@mitre.org

Vendor Advisory

https://jenkins.io/security/advisory/2017-07-10/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.