~ / search / GHSA-p9r2-gghq-hc57

GHSA-p9r2-gghq-hc57

Jenkins Multijob plugin did not check permissions in the Resume Build action

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000390

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:jenkins-multijob-plugin < 1.26 1.26

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the build. Multijob plugin 1.26 introduced a permission check requiring Overall/Administer. This was lowered to Job/Build in version 1.27.

References

External links from the advisory. They lead to third-party sites.