io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.17, <=1.27.18), org.jenkins-ci.plugins.workflow:workflow-multibranch (795.ve0cb_1f45ca_9a) +1 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3908.vd6b_b_5a_a_54010)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3908.vd6bb5aa54010 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.17,...

com.splunk.splunkins:splunk-devops-extend (>=1.0, <=1.7.0), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (>=1.8-beta-1, <=2.11) +2 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.2)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.splunk.splunkins:splunk-devops-extend =1.0, =1.8-beta-1, =1.8-beta-1,...

io.jenkins.blueocean:blueocean (>=1.0-alpha-3, <=1.0.0-b01), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-3, <=1.0.0-b01) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.8)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-3, =1.0-alpha-3, =1.0-alpha-3,...

com.arkea.satd:xlrelease-var-setter (>=0.2, <=0.4), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.0.0-b12) +3 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.22)

org.jenkins-ci.plugins:script-security MAVEN version 1.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.arkea.satd:xlrelease-var-setter =0.2, =1.0.0-b02, =1.2.1, =2.0, =0.1, =0.5 Sourc...

io.jenkins.plugins:pipeline-agent-build-history (74.v0f96046017ef) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3922.va_f73b_7c4246b)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3922.vaf73b7c4246b is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history...

GHSA-P2QQ-C693-Q53W Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

CVE-2024-52550

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main Jenkinsfile script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approv...

CVE-2024-52551

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

CVE-2024-52550

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main Jenkinsfile script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approv...

CVE-2024-52551

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.2.0-beta-1) +24 more potentially affected by CVE-2024-52551 via org.jenkinsci.plugins:pipeline-model-definition (>=0.1, <=2.2214.vb_b_34b_2ea_9b_83)

org.jenkinsci.plugins:pipeline-model-definition MAVEN version =0.1, =1.0.0-b02, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =0.1-preview-1, =3.1391.vcbaab9779d75, =365.vc5cf79113809, =2.0.7, =2.0.8 - org.jenkins-ci.plugins:convert-to-pipeline 1.0 and more Source cves:...

CVE-2024-52551

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

CVE-2024-52551

The Jenkins Pipeline: Declarative Plugin (version 2.2214.vb_b_34b_2ea_9b_83 and earlier) is vulnerable to a flaw where it fails to verify if a Jenkinsfile script used to restart a build from a specific stage is currently approved. An attacker with Item/Build permissions can exploit this to restar...

CVE-2024-52551

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

CVE-2024-52551

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

CVE-2024-52551

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

CVE-2024-52550

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main Jenkinsfile script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approv...

CVE-2024-52550

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main Jenkinsfile script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approv...

CVE-2024-52550

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main Jenkinsfile script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approv...

CVE-2024-52550

The Jenkins Pipeline: Groovy Plugin (version 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 ) fails to verify if the main Jenkinsfile script for a rebuilt build is approved. This allows an attacker with Item/Build permission to rebuild a previous build using a script that is no l...