Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Jenkins: Anyone can input data into pipelines with Item/Read access

CVE-2017-1000108 · published 9 years ago
Summary

A change has been made to require a stronger permission for interacting with pipeline steps. Users with only Item/Read access can no longer provide input, which should improve security. Update your Jenkins setup to ensure users have the required Item/Build permission for these interactions.

What to do
  • Update jenkins-ci org.jenkins-ci.plugins:pipeline-input-step to version 2.7.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:pipeline-input-step < 2.7
Fix: upgrade to 2.7
– jenkins pipeline-input-step 2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
cpe:2.3:a:jenkins:pipeline-input-step:2.0:*:*:*:*:jenkins:*:*
Original advisory text
The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the It...
The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published5 Oct 2017
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-hxpw-7x95-q38m · GHSA
CVE-2017-1000108 · NVD
Track software like this
Free during beta