Medium · 4.3 CVE-2018-1000114 EUVD-2022-3446GHSA-9rx5-w522-5fh7

Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes

Published Mar 13, 2018 · Updated Sep 16, 2024 · Assigned by mitre

Package: org.jenkins-ci.plugins:promoted-builds Ecosystem: Maven

Description

An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:promoted-builds	< 3.0	3.0	GHSA-9rx5-w522-5fh7

References

https://jenkins.io/security/advisory/2018-02-26/#SECURITY-746