GHSA-mrpr-vr82-x88r

Suggest an improvement
Source
https://github.com/advisories/GHSA-mrpr-vr82-x88r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-mrpr-vr82-x88r/GHSA-mrpr-vr82-x88r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mrpr-vr82-x88r
Aliases
Published
2024-11-13T21:30:38Z
Modified
2024-11-26T19:09:32.234731Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
Details

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": "2024-11-13T21:15:29Z",
    "cwe_ids": [
        "CWE-285",
        "CWE-354"
    ],
    "severity": "HIGH",
    "github_reviewed_at": "2024-11-14T15:41:46Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins.workflow:workflow-cps

Package

Name
org.jenkins-ci.plugins.workflow:workflow-cps
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3993.v3e20a

Affected versions

0.*
0.1-beta-1
0.1-beta-2
0.1-beta-3
0.1-beta-4
0.1-beta-5
0.1-beta-6
0.1-beta-7
0.1-beta-8
1.*
1.0-beta-1
1.0
1.1
1.2
1.3
1.4
1.4.1
1.4.2
1.4.3-beta-1
1.4.3
1.5
1.6-alpha-1
1.6
1.7-alpha-1
1.7
1.8
1.9-beta-1
1.9
1.10-beta-1
1.10
1.10.1
1.11-beta-1
1.11-beta-2
1.11-beta-3
1.11-beta-4
1.11
1.12-beta-1
1.12-beta-2
1.12-beta-3
1.12
1.13
1.14-beta-1
1.14
1.14.1-beta-1
1.14.1
1.14.2
1.15-beta-1
1.15
2.*
2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
2.19
2.20
2.21
2.22
2.23
2.24
2.25
2.26
2.27
2.28
2.29
2.30
2.30-stepstorage2-alpha
2.30-stepstorage2-alpha2
2.30-stepstorage4-beta
2.31
2.32
2.33
2.34
2.35
2.36
2.36.1
2.37
2.38
2.39
2.40
2.41
2.42
2.43
2.43-durability-beta-1
2.43-durability-beta-2
2.43-durability-beta-3
2.43-durability-beta-4
2.44
2.45
2.46
2.46.1
2.46.2
2.47
2.48
2.49
2.50
2.51
2.52
2.53
2.54
2.54.1
2.54.2
2.55
2.56
2.57
2.57.1
2.57.2
2.57.3
2.58-beta-1
2.58
2.59
2.60
2.61
2.61.1
2.61.2
2.61.3
2.62
2.63
2.64
2.65
2.66
2.66.1
2.67
2.68
2.69
2.70
2.71
2.72
2.73
2.74
2.74.1
2.75
2.76
2.77
2.78
2.79
2.80
2.81
2.82
2.83
2.84
2.85
2.86
2.87
2.88
2.89
2.90
2.91
2.92
2.92.1
2.93
2.94
2.94.1
2.94.4
2633.*
2633.v6baeedc13805
2640.*
2640.v00e79c8113de
2644.*
2644.v29a793dac95a
2646.*
2646.v6ed3b5b01ff1
2648.*
2648.va9433432b33c
2648.2651.v230593e03e9f
2656.*
2656.vf7a_e7b_75a_457
2659.*
2659.v52d3de6044d0
2660.*
2660.vb_c0412dc4e6d
2660.2664.v4c114e93f4c1
2680.*
2680.vf642ed4fa_d55
2682.*
2682.va_473dcddc941
2683.*
2683.vd0a_8f6a_1c263
2683.2687.vb_0cc3f973f06
2686.*
2686.v7c37e0578401
2687.*
2687.v3f09155513c1
2688.*
2688.v39a_b_e5c49a_65
2689.*
2689.v434009a_31b_f1
2692.*
2692.v76b_089ccd026
2705.*
2705.v0449852ee36f
2706.*
2706.v71dd22b_c5a_a_2
2710.*
2710.vcd48b_b_9e0e7d
2725.*
2725.v7b_c717eb_12ce
2729.*
2729.vea_17b_79ed57a_
2729.2732.vda_e3f07b_5a_f8
2746.*
2746.v0da_83a_332669
2746.2748.v365128b_c26d7
2759.*
2759.v87459c4eea_ca_
2759.2761.vd6e8d2a_15980
2784.*
2784.vd252824b_4eb_9
2801.*
2801.vf82a_b_b_e3e8a_5
2802.*
2802.v5ea_628154b_c2
2803.*
2803.v1a_f77ffcc773
3520.*
3520.va_8fc49e2f96f
3536.*
3536.vb_8a_6628079d5
3565.*
3565.v4b_d9b_8c29a_b_3
3581.*
3581.v2b_e4c99c76ed
3583.*
3583.v4f58de0d78d5
3601.*
3601.v9b_36a_d99e1cc
3606.*
3606.v0b_d8b_e512dcf
3611.*
3611.v201b_d9f9eb_f7
3616.*
3616.vb_2e7168f4b_0c
3618.*
3618.v13db_a_21f0fcf
3624.*
3624.v43b_a_38b_62b_b_7
3626.*
3626.v4eb_a_7d8b_2fa_4
3629.*
3629.v8177e69e359a_
3635.*
3635.vedb_8602eefa_c
3637.*
3637.v63b_c17e0ed5b_
3641.*
3641.vf58904a_b_b_5d8
3651.*
3651.ve2e99a_4f4a_e5
3653.*
3653.v07ea_433c90b_4
3659.*
3659.v582dc37621d8
3668.*
3668.v1763b_b_6ccffd
3673.*
3673.v5b_dd74276262
3691.*
3691.v28b_14c465a_b_b_
3693.*
3693.vd5c06270e4dc
3697.*
3697.vb_470e454c232
3697.3699.v9cfca_8c0db_0c
3705.*
3705.va_6a_c2775a_c17
3713.*
3713.vd671d4321509
3717.*
3717.va_180a_fe9d3cd
3722.*
3722.v85ce2a_c6240b_
3726.*
3726.v83f8cff396c9
3728.*
3728.vd5c88eef9154
3731.*
3731.ve4b_5b_857b_a_d3
3732.*
3732.vb_77c00a_57e12
3740.*
3740.v6d35b_4ed5f9f
3744.*
3744.v6f2c0fe0e54d
3767.*
3767.vdd3e0a_65b_ef3
3769.*
3769.v8b_e595e4d40d
3773.*
3773.v505e0052522c
3774.*
3774.v4a_d648d409ce
3785.*
3785.vee73da_b_9544e
3787.*
3787.v8f5dcd14a_fa_c
3791.*
3791.va_c0338ea_b_59c
3793.*
3793.v65dec41c3a_c3
3802.*
3802.vd42b_fcf00b_a_c
3805.*
3805.v769b_b_74b_db_14
3806.*
3806.va_3a_6988277b_2
3812.*
3812.vc3031a_b_a_c955
3817.*
3817.vd20b_7e2b_692b_
3821.*
3821.v9d3888c583b_1
3826.*
3826.v3b_5707fe44da_
3832.*
3832.vc43e04d6d68c
3835.*
3835.vc2a_8f9167e92
3837.*
3837.v305192405b_c0
3853.*
3853.vb_a_490d892963
3859.*
3859.v7f65cc865019
3867.*
3867.v535458ce43fd
3880.*
3880.vb_ef4b_5cfd270
3883.*
3883.vb_3ff2a_e3eea_f
3889.*
3889.v937e0b_3412d3
3894.*
3894.vd0f0248b_a_fc4
3894.3896.vca_2c931e7935
3903.*
3903.v48a_8836749e9
3908.*
3908.vd6b_b_5a_a_54010
3922.*
3922.va_f73b_7c4246b_
3943.*
3943.v3519a_3260660
3946.*
3946.v7935cb_edb_f82
3953.*
3953.v19f11da_8d2fa_
3961.*
3961.ve48ee2c44a_b_3
3964.*
3964.v0767b_4b_a_0b_fa_
3969.*
3969.vdc9d3a_efcc6a_
3975.*
3975.v567e2a_1ffa_22
3975.3977.v478dd9e956c3
3990.*
3990.vd281dd77a_388

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-mrpr-vr82-x88r/GHSA-mrpr-vr82-x88r.json"