{"schema_version":"1.7.3","id":"GHSA-mrpr-vr82-x88r","published":"2024-11-13T21:30:38Z","modified":"2024-11-26T19:08:33.479175Z","aliases":["CVE-2024-52550"],"summary":"Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin ","details":"Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a_37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.\n","affected":[{"package":{"name":"org.jenkins-ci.plugins.workflow:workflow-cps","ecosystem":"Maven","purl":"pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3993.v3e20a"}]}],"versions":["0.1-beta-1","0.1-beta-2","0.1-beta-3","0.1-beta-4","0.1-beta-5","0.1-beta-6","0.1-beta-7","0.1-beta-8","1.0","1.0-beta-1","1.1","1.10","1.10-beta-1","1.10.1","1.11","1.11-beta-1","1.11-beta-2","1.11-beta-3","1.11-beta-4","1.12","1.12-beta-1","1.12-beta-2","1.12-beta-3","1.13","1.14","1.14-beta-1","1.14.1","1.14.1-beta-1","1.14.2","1.15","1.15-beta-1","1.2","1.3","1.4","1.4.1","1.4.2","1.4.3","1.4.3-beta-1","1.5","1.6","1.6-alpha-1","1.7","1.7-alpha-1","1.8","1.9","1.9-beta-1","2.0","2.1","2.10","2.11","2.12","2.13","2.14","2.15","2.16","2.17","2.18","2.19","2.2","2.20","2.21","2.22","2.23","2.24","2.25","2.26","2.27","2.28","2.29","2.3","2.30","2.30-stepstorage2-alpha","2.30-stepstorage2-alpha2","2.30-stepstorage4-beta","2.31","2.32","2.33","2.34","2.35","2.36","2.36.1","2.37","2.38","2.39","2.4","2.40","2.41","2.42","2.43","2.43-durability-beta-1","2.43-durability-beta-2","2.43-durability-beta-3","2.43-durability-beta-4","2.44","2.45","2.46","2.46.1","2.46.2","2.47","2.48","2.49","2.5","2.50","2.51","2.52","2.53","2.54","2.54.1","2.54.2","2.55","2.56","2.57","2.57.1","2.57.2","2.57.3","2.58","2.58-beta-1","2.59","2.6","2.60","2.61","2.61.1","2.61.2","2.61.3","2.62","2.63","2.64","2.65","2.66","2.66.1","2.67","2.68","2.69","2.7","2.70","2.71","2.72","2.73","2.74","2.74.1","2.75","2.76","2.77","2.78","2.79","2.8","2.80","2.81","2.82","2.83","2.84","2.85","2.86","2.87","2.88","2.89","2.9","2.90","2.91","2.92","2.92.1","2.93","2.94","2.94.1","2.94.4","2633.v6baeedc13805","2640.v00e79c8113de","2644.v29a793dac95a","2646.v6ed3b5b01ff1","2648.2651.v230593e03e9f","2648.va9433432b33c","2656.vf7a_e7b_75a_457","2659.v52d3de6044d0","2660.2664.v4c114e93f4c1","2660.vb_c0412dc4e6d","2680.vf642ed4fa_d55","2682.va_473dcddc941","2683.2687.vb_0cc3f973f06","2683.vd0a_8f6a_1c263","2686.v7c37e0578401","2687.v3f09155513c1","2688.v39a_b_e5c49a_65","2689.v434009a_31b_f1","2692.v76b_089ccd026","2705.v0449852ee36f","2706.v71dd22b_c5a_a_2","2710.vcd48b_b_9e0e7d","2725.v7b_c717eb_12ce","2729.2732.vda_e3f07b_5a_f8","2729.vea_17b_79ed57a_","2746.2748.v365128b_c26d7","2746.v0da_83a_332669","2759.2761.vd6e8d2a_15980","2759.v87459c4eea_ca_","2784.vd252824b_4eb_9","2801.vf82a_b_b_e3e8a_5","2802.v5ea_628154b_c2","2803.v1a_f77ffcc773","3520.va_8fc49e2f96f","3536.vb_8a_6628079d5","3565.v4b_d9b_8c29a_b_3","3581.v2b_e4c99c76ed","3583.v4f58de0d78d5","3601.v9b_36a_d99e1cc","3606.v0b_d8b_e512dcf","3611.v201b_d9f9eb_f7","3616.vb_2e7168f4b_0c","3618.v13db_a_21f0fcf","3624.v43b_a_38b_62b_b_7","3626.v4eb_a_7d8b_2fa_4","3629.v8177e69e359a_","3635.vedb_8602eefa_c","3637.v63b_c17e0ed5b_","3641.vf58904a_b_b_5d8","3651.ve2e99a_4f4a_e5","3653.v07ea_433c90b_4","3659.v582dc37621d8","3668.v1763b_b_6ccffd","3673.v5b_dd74276262","3691.v28b_14c465a_b_b_","3693.vd5c06270e4dc","3697.3699.v9cfca_8c0db_0c","3697.vb_470e454c232","3705.va_6a_c2775a_c17","3713.vd671d4321509","3717.va_180a_fe9d3cd","3722.v85ce2a_c6240b_","3726.v83f8cff396c9","3728.vd5c88eef9154","3731.ve4b_5b_857b_a_d3","3732.vb_77c00a_57e12","3740.v6d35b_4ed5f9f","3744.v6f2c0fe0e54d","3767.vdd3e0a_65b_ef3","3769.v8b_e595e4d40d","3773.v505e0052522c","3774.v4a_d648d409ce","3785.vee73da_b_9544e","3787.v8f5dcd14a_fa_c","3791.va_c0338ea_b_59c","3793.v65dec41c3a_c3","3802.vd42b_fcf00b_a_c","3805.v769b_b_74b_db_14","3806.va_3a_6988277b_2","3812.vc3031a_b_a_c955","3817.vd20b_7e2b_692b_","3821.v9d3888c583b_1","3826.v3b_5707fe44da_","3832.vc43e04d6d68c","3835.vc2a_8f9167e92","3837.v305192405b_c0","3853.vb_a_490d892963","3859.v7f65cc865019","3867.v535458ce43fd","3880.vb_ef4b_5cfd270","3883.vb_3ff2a_e3eea_f","3889.v937e0b_3412d3","3894.3896.vca_2c931e7935","3894.vd0f0248b_a_fc4","3903.v48a_8836749e9","3908.vd6b_b_5a_a_54010","3922.va_f73b_7c4246b_","3943.v3519a_3260660","3946.v7935cb_edb_f82","3953.v19f11da_8d2fa_","3961.ve48ee2c44a_b_3","3964.v0767b_4b_a_0b_fa_","3969.vdc9d3a_efcc6a_","3975.3977.v478dd9e956c3","3975.v567e2a_1ffa_22","3990.vd281dd77a_388"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-mrpr-vr82-x88r/GHSA-mrpr-vr82-x88r.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52550"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/workflow-cps-plugin"},{"type":"WEB","url":"https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362"}],"database_specific":{"cwe_ids":["CWE-285","CWE-354"],"github_reviewed":true,"github_reviewed_at":"2024-11-14T15:41:46Z","nvd_published_at":"2024-11-13T21:15:29Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}]}