Vulnerabilities for Pipeline (...) - CXSECURITY.COM

Vulnerabilities for 'Pipeline'

2019-07-31

CVE-2019-10357

CWE-275

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.

2019-03-28

CVE-2019-1003041

CWE-254

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

2019-03-08

CVE-2019-1003030

CWE-254

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

2019-01-22

CVE-2019-1003002

CWE-254

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CVE-2019-1003001

CWE-254

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

2018-12-10

CVE-2018-1000866

CWE-269

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM

2017-10-04

CVE-2017-1000096

CWE-732

Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

CVE-2017-1000089

CWE-276

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

>>> Vendor: Jenkins 480 Products

Active directory

Pluggable authentication module

Build failure analyzer

Vrealize orchestrator

Openstack cloud

Image gallery plugin

Extra columns plugin

Script security

Github branch source

Config file provider

Owasp dependency-check

Pipeline-input-step

Deploy to container

Static analysis utilities

Periodic backup

Role-based authorization strategy

Parameterized trigger

Favorite plugin

Translation assistance

Pipeline nodes and processes

Delivery pipeline

Build-publisher

Dependency graph viewer

Global-build-stats

Credentials binding

Pipeline supporting apis

Google-play-android-publisher

Promoted builds

Job and node ownership

Cucumber living documentation

Github pull request builder

Reverse proxy auth

Liquibase runner

See all Products for Vendor Jenkins

Copyright 2024, cxsecurity.com