GHSA-p8x8-p473-mmmv

Missing Authorization in Jenkins

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000400

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	< 2.73.2	2.73.2
Maven	org.jenkins-ci.main:jenkins-core	>= 2.74, < 2.84	2.84

Details

As written in the advisory (Markdown source, shown as plain text).

The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only lists upstream and downstream projects that the current user has access to.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000400 advisory
https://github.com/jenkinsci/jenkins/commit/b2083a387a5bdb6f7ee7f7c81a1f6312aca2a558 web
https://github.com/jenkinsci/jenkins package
https://github.com/jenkinsci/jenkins/blob/6d179998e18adfbaa4e443c7e837135bf36c53d7/test/src/test/java/hudson/model/AbstractProjectTest.java web
https://jenkins.io/security/advisory/2017-10-11 web