CVE-2017-1000084: Parameterized Trigger Plugin fails to check Item/Build permission in org.jenkins-ci.plugins:parameterized-trigger
Summary
CVE-2017-1000084: Parameterized Trigger Plugin fails to check Item/Build permission. Affects org.jenkins-ci.plugins:parameterized-trigger versions < 2.35.1. Fixed in 2.35.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Parameterized Trigger Plugin is a plugin for Jenkins, an open-source automation server. It allows users to trigger downstream builds with parameters. The plugin is an essential tool for automating workflows and managing dependencies between projects in Jenkins. However, a vulnerability in the plugin allows unauthorized triggering of downstream builds, bypassing the Item/Build permission check.
Vulnerability Detail
The Parameterized Trigger Plugin did not properly check the build authentication it was running as, allowing any user to trigger any other project in Jenkins. This vulnerability could lead to unauthorized access to sensitive information or the execution of malicious code. The vulnerability has been assigned a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.35.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the fixed version.
Conclusion
The Parameterized Trigger Plugin in Jenkins is vulnerable to unauthorized triggering of downstream builds. It is crucial to update the plugin to version 2.35.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:parameterized-trigger →
FAQ
The Parameterized Trigger Plugin is a plugin for Jenkins that allows users to trigger downstream builds with parameters. It is commonly used for automating workflows and managing dependencies between projects.
This vulnerability allows unauthorized users to trigger downstream builds in Jenkins, potentially leading to unauthorized access to sensitive information or the execution of malicious code.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
No, there is no known workaround for this vulnerability. It is crucial to update the Parameterized Trigger Plugin to the fixed version.
To fix this vulnerability, update the Parameterized Trigger Plugin to version 2.35.1 or later. This version includes the necessary fix to properly check for Item/Build permission before triggering a downstream build.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:parameterized-trigger.
