CVE-2017-1000108

Published: Oct 5, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead.

Affected (8)

Products: Jenkins: Pipeline Input Step

Jenkins

1 product

Pipeline Input Step

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Jenkins Pipeline Input Step	Version 2.0
Jenkins Pipeline Input Step	Version 2.1
Jenkins Pipeline Input Step	Version 2.2
Jenkins Pipeline Input Step	Version 2.3
Jenkins Pipeline Input Step	Version 2.4
Jenkins Pipeline Input Step	Version 2.5
Jenkins Pipeline Input Step	Version 2.6
Jenkins Pipeline Input Step	Version 2.7

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://jenkins.io/security/advisory/2017-08-07/

Source: cve@mitre.org

Vendor Advisory

https://jenkins.io/security/advisory/2017-08-07/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.