CVE-2018-1000107: Improper authorization in Jenkins Job and Node Ownership Plugin
Summary
CVE-2018-1000107: Improper authorization in Jenkins Job and Node Ownership Plugin. Affects com.synopsys.jenkinsci:ownership versions < 0.12.0. Fixed in 0.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Job and Node Ownership Plugin is a Maven package (com.synopsys.jenkinsci:ownership) that provides ownership management functionality for jobs and nodes in the Jenkins automation server. It allows users to assign ownership of jobs and nodes to specific individuals or teams, enabling better collaboration and access control. However, versions 0.11.0 and earlier of the plugin are vulnerable to an improper authorization issue.
Vulnerability Detail
The vulnerability in Jenkins Job and Node Ownership Plugin (CVE-2018-1000107) arises from improper authorization checks in the OwnershipDescription.java, JobOwnerJobProperty.java, and OwnerNodeProperty.java files. Attackers with Job/Configure or Computer/Configure permissions, but without ownership-related permissions, can exploit this vulnerability to override ownership metadata. This could lead to unauthorized access, manipulation, or disruption of job and node ownership, potentially compromising the integrity and security of the Jenkins environment.
How To Fix
Minimum fixed version
0.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict Job/Configure and Computer/Configure permissions to trusted individuals or teams who also have ownership-related permissions. By ensuring that only authorized users have these permissions, the risk of exploitation can be mitigated. However, this workaround may limit the flexibility and collaboration potential of the plugin.
Conclusion
The Jenkins Job and Node Ownership Plugin versions 0.11.0 and earlier are vulnerable to an improper authorization issue that allows attackers to override ownership metadata. To mitigate this vulnerability, it is crucial to upgrade to version 0.12.0 or later of the plugin. Users can also apply temporary workarounds by restricting certain permissions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.synopsys.jenkinsci:ownership →
FAQ
The vulnerability allows attackers with specific permissions to override ownership metadata, potentially leading to unauthorized access, manipulation, or disruption of job and node ownership in the Jenkins environment.
Users of Jenkins Job and Node Ownership Plugin versions 0.11.0 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to promptly apply the recommended fixes to mitigate the risk.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.synopsys.jenkinsci:ownership.
