CVE-2017-1000108: Jenkins Pipeline: Input Step Plugin - User Interaction Vulnerability
Summary
CVE-2017-1000108: Jenkins Pipeline: Input Step Plugin. Affects org.jenkins-ci.plugins:pipeline-input-step versions < 2.7. Fixed in 2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Pipeline: Input Step Plugin is a plugin for Jenkins, an open-source automation server. It allows users to define and orchestrate continuous delivery pipelines as code. The Input Step Plugin specifically provides a step that allows users to interact with a pipeline by providing input. This input can be used to make decisions or gather information during the pipeline execution.
Vulnerability Detail
The Pipeline: Input Step Plugin had a vulnerability that allowed users with Item/Read access to interact with the input step. This means that any user with read access to the pipeline could potentially influence the pipeline execution by providing input. This vulnerability could be exploited by malicious users to disrupt or manipulate the pipeline process, leading to unauthorized actions or data breaches. The vulnerability has been addressed by changing the required permission to Item/Build, ensuring that only users with build permission can interact with the input step.
How To Fix
Minimum fixed version
2.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately feasible, a temporary workaround is to restrict Item/Read access to trusted users only. By limiting read access to the pipeline, the vulnerability can be mitigated until the plugin can be updated.
Conclusion
The Jenkins Pipeline: Input Step Plugin had a vulnerability that allowed users with Item/Read access to interact with the input step. This could potentially lead to unauthorized actions or data breaches. The vulnerability has been addressed by requiring users to have Item/Build permission. It is recommended to update the plugin to the latest version to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-input-step →
FAQ
This vulnerability allows users with read access to a pipeline to interact with the input step, potentially influencing the pipeline execution. This can lead to unauthorized actions or data breaches.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
The Pipeline: Input Step Plugin now requires users to have Item/Build permission to interact with the input step.
Yes, you can restrict Item/Read access to trusted users only as a temporary workaround until the plugin can be updated.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-input-step.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
