CVE-2017-1000105 Missing Authorization in Jenkins Blue Ocean Plugin
Attackers with Item/Read permissions can access archived artifacts in Jenkins Blue Ocean without the required Run/Artifacts permission.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-1000105?
CVE-2017-1000105 is a medium-severity missing authorization vulnerability in n/a, published on 4 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient.
Weakness: CWE-862
Which versions are affected by CVE-2017-1000105?
2 open source packages ship an affected version, including io.jenkins.blueocean:blueocean. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.jenkins.blueocean:blueocean Maven | All versions to 1.2.4 | None |
io.jenkins.blueocean:blueocean Maven | All versions to 1.2.4 | None |
Products include Jenkins Blue Ocean.
How do I fix CVE-2017-1000105?
No fix has been published for CVE-2017-1000105 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-1000105 being exploited?
There is no known exploitation of CVE-2017-1000105 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-40341 Jenkins Blue Ocean Plugin cross-site request forgery vulnerability
- CVE-2017-1000106 Improper Authentication in Jenkins Blue Ocean Plugin
- CVE-2022-30952 Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin
- CVE-2022-30953 Cross Site Request Forgery in Jenkins Blue Ocean Plugin
- CVE-2022-30954 Missing permission check in Jenkins Blue Ocean Plugin
Sources
Also known as GHSA-phf8-3qgv-rg5q.