Improper Authentication in Jenkins Blue Ocean Plugin

published 2017-10-04 9 y ago modified 2026-06-17 4 mo ago also GHSA-rm5m-9mx4-g5r7 , EUVD-2022-5196

cvss: 4.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits: 0; none known

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when configuring existing GitHub organization folders. This allowed users with read access to the GitHub organization folder to reconfigure it, including changing the GitHub API endpoint for the organization folder to an attacker-controlled server to obtain the GitHub access token, if the organization folder was initially created using Blue Ocean.

Patch / fix

fixed in 1

maven io.jenkins.blueocean:blueocean 1.2.0

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N
GitHub	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	io.jenkins.blueocean:blueocean	<1.2.0	1.2.0

Classification

Weakness

CWE-287 Improper Authentication

References

jenkins.io /security/advisory/2017-08-07/
vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2017-1000110
advisory
jenkins.io /security/advisory/2017-08-07
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary