Input validation

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

CVE-2017-1000105: Missing Authorization

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient...

CVE-2017-1000108: Exposure of Sensitive Information to an Unauthorized Actor

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

CVE-2017-1000108

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

PT-2017-10813

Name of the Vulnerable Software and Affected Versions Jenkins versions affected versions not specified Description The issue concerns the Pipeline: Input Step Plugin, which previously allowed users with Item/Read access to interact with the step. This has been changed to require Item/Build...