CVE-2017-1000089
Jenkins Build Step Plugin fails to check Item/Build permission
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
- Record
CVE-2017-1000089- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
CVE List No score
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
- Record
CVE-2017-1000089- Updated
- 2026-11-02
EUVDEUVD-2022-3197 No score
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
- Record
EUVD-2022-3197- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jx9-7j5m-79x4
Jenkins Build Step Plugin fails to check Item/Build permission
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
- Record
GHSA-8jx9-7j5m-79x4- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
OSV
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
- Record
CVE-2017-1000089- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-8jx9-7j5m-79x4
Jenkins Build Step Plugin fails to check Item/Build permission
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
- Record
GHSA-8jx9-7j5m-79x4- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVRHBA-2017:2642
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.6.1 bug fix and enhancement update
- Record
RHBA-2017:2642- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:pipeline-build-stepMaven |
through 2.5 | 2.5.1 |
org.jenkins-ci.plugins:pipeline-build-stepMaven |
before 2.5.1, plus listed versions 2.02.12.22.32.42.5 |
2.5.1 |
atomic-openshiftRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-clientsRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-cluster-capacityRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-dockerregistryRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-excluderRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-federation-servicesRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshift-masterRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-nodeRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-podRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-service-catalogRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
atomic-openshift-testsRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
fluentdRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.12.39-2.el7 | 0:0.12.39-2.el7 |
fluentd-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.12.39-2.el7 | 0:0.12.39-2.el7 |
jenkins-2-pluginsRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.7.1502412812-1.el7 | 0:3.7.1502412812-1.el7 |
kibanaRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:4.6.4-3.el7 | 0:4.6.4-3.el7 |
kibana-debuginfoRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:4.6.4-3.el7 | 0:4.6.4-3.el7 |
rubygem-cool.ioRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:1.5.1-1.el7 | 0:1.5.1-1.el7 |
rubygem-cool.io-debuginfoRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:1.5.1-1.el7 | 0:1.5.1-1.el7 |
rubygem-cool.io-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:1.5.1-1.el7 | 0:1.5.1-1.el7 |
rubygem-exconRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.58.0-1.el7 | 0:0.58.0-1.el7 |
rubygem-excon-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.58.0-1.el7 | 0:0.58.0-1.el7 |
rubygem-faradayRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.13.0-1.el7 | 0:0.13.0-1.el7 |
rubygem-faraday-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.13.0-1.el7 | 0:0.13.0-1.el7 |
rubygem-fluent-plugin-kubernetes_metadata_filterRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.29.0-1.el7 | 0:0.29.0-1.el7 |
rubygem-fluent-plugin-kubernetes_metadata_filter-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.29.0-1.el7 | 0:0.29.0-1.el7 |
rubygem-fluent-plugin-viaq_data_modelRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.0.5-1.el7 | 0:0.0.5-1.el7 |
rubygem-fluent-plugin-viaq_data_model-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.0.5-1.el7 | 0:0.0.5-1.el7 |
rubygem-i18nRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.8.6-1.el7 | 0:0.8.6-1.el7 |
rubygem-i18n-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:0.8.6-1.el7 | 0:0.8.6-1.el7 |
rubygem-systemd-journalRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:1.3.0-1.el7 | 0:1.3.0-1.el7 |
rubygem-systemd-journal-docRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:1.3.0-1.el7 | 0:1.3.0-1.el7 |
tuned-profiles-atomic-openshift-nodeRed Hat:openshift:3.6::el7 From an advisory covering 4 CVEs |
before 0:3.6.173.0.21-1.git.0.f95b0e7.el7 | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000089 is a medium vulnerability (CVSS 5.3) in Jenkins Pipeline\, published October 4, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in org.jenkins-ci.plugins:pipeline-build-step 2.5.1.
References
jenkins.io/security/advisory/2017-07-10
nvd.nist.gov/vuln/detail/CVE-2017-1000089
github.com/advisories/GHSA-8jx9-7j5m-79x4
access.redhat.com/errata/RHBA-2017:2642
bugzilla.redhat.com/show_bug.cgi?id=1420976
Show 25 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2017/rhba-2017_2642.json
cve.org/CVERecord?id=CVE-2017-1000085