Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue Ocean. The SCM content REST API did not check the current user's authentication or credentials. If the GitHub organization folder was created via Blue Ocean, it retained a reference to its creator's GitHub credentials. This allowed users with read access to the GitHub organization folder to create arbitrary commits in the repositories inside the GitHub organization corresponding to the GitHub organization folder with the GitHub credentials of the creator of the organization folder. Additionally, users with read access to the GitHub organization folder could read arbitrary file contents from the repositories inside the GitHub organization corresponding to the GitHub organization folder if the branch contained a Jenkinsfile (which could be created using the other part of this vulnerability), and they could provide the organization folder name, repository name, branch name, and file name.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | io.jenkins.blueocean:blueocean | < 1.2.0 | 1.2.0 |
Referencias
- Vector CVSS
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N- Debilidad (CWE)
CWE-287- Plataforma
- Java / Kotlin (Maven)
- Paquete
io.jenkins.blueocean:blueocean- Publicada
- 13.05.2022
- Actualizado
- 11.10.2026 11:21
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-qgjq-m78x-4gm8 - CC BY 4.0
Historial de vulnerabilidades: io.jenkins.blueocean:blueocean
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 8
- Primera → última
- 05.2022 08.2023
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 7
Divulgaciones por año
- 2022: 7
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 0
-
Improper Authentication in Jenkins Blue Ocean Plugin esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.