TI-2018-15677 Aliases CVE-2018-1000015 GHSA-9r7f-rqhw-j8h8

On Jenkins instances with Authorize Project plugin, the authentication associated with a…

LOW 24CWE-862Published 2018-01-23 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.

Summary

On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline `node` blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin 2.17 and earlier.

Why it matters now

EPSS 0.01031 63rd percentileScored 2026-11-07

Fix Partial org.jenkins-ci.plugins.workflow:workflow-durable-task-step (Maven): 2.18Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.jenkins-ci.plugins.workflow:workflow-durable-task-step (Maven)	before 2.18	2.18	Patch available	GHSA-9r7f-rqhw-j8h8

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.jenkins-ci.plugins.workflow:workflow-durable-task-step (Maven) Vendor— Affected before 2.18 Fixed in 2.18 Patch available GHSA-9r7f-rqhw-j8h8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:pipeline_nodes_and_processes::::::jenkins::*	up to 2.17	Vulnerable	Jenkins

cpe:2.3:a:jenkins:pipeline_nodes_and_processes:*:*:*:*:*:jenkins:*:* Versions up to 2.17 Vulnerable ·Jenkins

Remediation

Fix · GHSA-9r7f-rqhw-j8h8 org.jenkins-ci.plugins.workflow:workflow-durable-task-step (Maven) Fixed in 2.18 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Enterprise 3	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2018-1000015
2026-10-03 Alias added: GHSA-9r7f-rqhw-j8h8

References

Advisory 2

Other 1

https://jenkins.io/security/advisory/2018-01-22

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences