Blue Ocean allows the creation of GitHub organization folders that are set up to scan a…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when configuring existing GitHub organization folders. This allowed users with read access to the GitHub organization folder to reconfigure it, including changing the GitHub API endpoint for the organization folder to an attacker-controlled server to obtain the GitHub access token, if the organization folder was initially created using Blue Ocean.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | io.jenkins.blueocean:blueocean (Maven) | before 1.2.0 | 1.2.0 | Patch available | GHSA-rm5m-9mx4-g5r7 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- io.jenkins.blueocean:blueocean (Maven) Vendor— Affected before 1.2.0 Fixed in 1.2.0 Patch available GHSA-rm5m-9mx4-g5r7
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:blue_ocean:*:*:*:*:*:jenkins:*:* | up to 1.1.5 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:blue_ocean:1.2.0:beta-1:*:*:*:jenkins:*:* | 1.2.0 beta-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:blue_ocean:1.2.0:beta-2:*:*:*:jenkins:*:* | 1.2.0 beta-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:blue_ocean:1.2.0:beta-3:*:*:*:jenkins:*:* | 1.2.0 beta-3 | Vulnerable | Jenkins |
- cpe:2.3:a:jenkins:blue_ocean:*:*:*:*:*:jenkins:*:* Versions up to 1.1.5 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:blue_ocean:1.2.0:beta-1:*:*:*:jenkins:*:* Versions 1.2.0 beta-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:blue_ocean:1.2.0:beta-2:*:*:*:jenkins:*:* Versions 1.2.0 beta-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:blue_ocean:1.2.0:beta-3:*:*:*:jenkins:*:* Versions 1.2.0 beta-3 Vulnerable ·Jenkins
Remediation
- Fix · GHSA-rm5m-9mx4-g5r7 io.jenkins.blueocean:blueocean (Maven) Fixed in 1.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-1000110
- 2026-10-03 Alias added: GHSA-rm5m-9mx4-g5r7
References
More Jenkins Blue Ocean vulnerabilities
- TI-2023-21170 Cross-site request forgery in Jenkins Blue Ocean Plugin CVSS 3.1HIGH 8.8
- TI-2017-14443 Blue Ocean allows the creation of GitHub organization folders that are set up to scan a… CVSS 3.0HIGH 8.5
- TI-2020-02131 Path traversal in Jenkins Blue Ocean Plugin CVSS 3.1MEDIUM 6.5
- TI-2022-13010 Missing authorization in Jenkins Blue Ocean Plugin CVSS 3.1MEDIUM 6.5
- TI-2022-13008 Insufficiently protected credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin CVSS 3.1MEDIUM 6.5
- TI-2019-15857 Cross-site request forgery in Jenkins Blue Ocean Plugins CVSS 3.0MEDIUM 6.5
Sources
- CVE-2017-1000110 · CVE Program
- CVE-2017-1000110 · NVD
- FIRST EPSS
- GHSA-rm5m-9mx4-g5r7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences