high7.5
CVE-2017-1000108
Jenkins Pipeline: Input Step Plugin
Impact
The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:pipeline-input-step | < 2.7 | 2.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Pipeline-Input-Step | Versions 2.0, 2.1, 2.2, 2.3, 2.4, 2.5 |