CVE-2017-1000084: Incorrect Default Permissions

May 13, 2022 (updated December 6, 2022)

Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin does not check the build authentication it was running as and allowed triggering any other project in Jenkins.

References

github.com/advisories/GHSA-mc22-25r3-2w9w
github.com/jenkinsci/parameterized-trigger-plugin/pull/114
issues.jenkins.io/browse/JENKINS-45471
jenkins.io/security/advisory/2017-07-10/
nvd.nist.gov/vuln/detail/CVE-2017-1000084

Detect and mitigate CVE-2017-1000084 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →