CVE-2017-1000105

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10001068.5Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches coCVE-2017-10001078.8Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invCVE-2017-10001087.5The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. ThiCVE-2017-10001096.1The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripCVE-2017-10001104.3Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches coCVE-2017-10001117.8Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a sCVE-2017-10001127.0Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() cCVE-2017-10001135.5The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file CVE-2017-10001143.1The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypteCVE-2017-10001157.5Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repositoCVE-2017-10001169.8Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.CVE-2017-10001178.8A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any prog
CVE-2017-1000105: Medium severity, CVSS 5.3 | Vulnix