CVE-2017-1000086: Missing Authorization

May 13, 2022 (updated January 30, 2024)

The Periodic Backup Plugin does not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

References

www.securityfocus.com/bid/100437
github.com/advisories/GHSA-5293-3fgp-cr3x
jenkins.io/security/advisory/2017-07-10/
nvd.nist.gov/vuln/detail/CVE-2017-1000086

Detect and mitigate CVE-2017-1000086 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →