CVE-2017-1000084
medium
CVSS v3
6.5
CVSS v2
4.0
VIR risk
6.5
Description
Parameterized Trigger Plugin fails to check Item/Build permission
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://jenkins.io/security/advisory/2017-07-10/
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:parameterized-trigger | <2.35.1 | 2.35.1 |
Application impact
References
- https://jenkins.io/security/advisory/2017-07-10/
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000084
- https://github.com/jenkinsci/parameterized-trigger-plugin/pull/114
- https://github.com/fbelzunc/parameterized-trigger-plugin/commit/345d54f8f031bef68ecb6fd4e7eee0be720162e4
- https://github.com/jenkinsci/parameterized-trigger-plugin
- https://issues.jenkins.io/browse/JENKINS-45471
- https://jenkins.io/security/advisory/2017-07-10
CWEs
CWE-276
Verify integrity in audit chain (admin only). AS-IS.