CVE-2017-1000089 Jenkins Build Step Plugin fails to check Item/Build permission

What is CVE-2017-1000089?

CVE-2017-1000089 is a medium-severity missing authorization vulnerability in n/a, published on 4 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

Weakness: CWE-276

Which versions are affected by CVE-2017-1000089?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:pipeline-build-step. It affects 1 product.

Products include Jenkins Pipeline\.

How do I fix CVE-2017-1000089?

Upgrade org.jenkins-ci.plugins:pipeline-build-step to 2.5.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2017-1000089 being exploited?

There is no known exploitation of CVE-2017-1000089 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-1003030 Jenkins Matrix Project Plugin Remote Code Execution Exploited Critical 9.9
• CVE-2022-43402 Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution Critical 9.9
• CVE-2019-1003041 Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin Critical 9.8
• CVE-2022-43407 CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin High 8.8
• CVE-2022-25173 Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8jx9-7j5m-79x4.