CVE-2017-1000108: Information Exposure

October 5, 2017 (updated November 1, 2017)

Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead.

References

jenkins.io/security/advisory/2017-08-07/
nvd.nist.gov/vuln/detail/CVE-2017-1000108

Code Behaviors & Features

Detect and mitigate CVE-2017-1000108 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →