CVE-2017-1000089

Published: Oct 5, 2017Modified: May 13, 2026

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

Affected (1)

Products: Jenkins: Pipeline\

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Pipeline\	Up to 2.5

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (2)

https://jenkins.io/security/advisory/2017-07-10/

Source: cve@mitre.org

Vendor Advisory

https://jenkins.io/security/advisory/2017-07-10/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.