CVE-2018-1000015: Medium severity jenkins pipeline vulnerability
On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline node blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin 2.17 and earlier.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000015?
CVE-2018-1000015 has a medium severity, primarily affecting Jenkins instances with the Authorize Project plugin.
How do I fix CVE-2018-1000015?
To fix CVE-2018-1000015, upgrade the affected versions of Jenkins and the related plugins to 2.18 or later.
Which Jenkins versions are affected by CVE-2018-1000015?
Jenkins versions prior to 2.18, specifically those using the Authorize Project plugin and Pipeline: Nodes and Processes up to 2.17, are affected by CVE-2018-1000015.
What is the main issue caused by CVE-2018-1000015?
CVE-2018-1000015 allows unauthorized execution of Pipeline `node` blocks on certain agents due to incorrect permission checks.
Is CVE-2018-1000015 a known vulnerability?
Yes, CVE-2018-1000015 is a documented vulnerability that has been recognized in the Jenkins security advisory.