Bug 1565688 (CVE-2017-1000243)

Summary: CVE-2017-1000243 jenkins-plugin-favorite: Missing permission check in Favorite Plugin allows anyone to change favorites for any other user
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ahardin, bleanhar, ccoleman, dedgar, jgoulding, jokerman, mchappel
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins-favorite-plugin 2.3.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-21 20:00:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1565804    
Bug Blocks: 1565691    

Description Andrej Nemec 2018-04-10 14:33:03 UTC
A missing permission check allowed any user to add or remove favorites for any other user.

The API was changed so users cannot change another user’s favorites, only their own.

External References:

https://jenkins.io/security/advisory/2017-06-06/

Upstream patch:

https://github.com/jenkinsci/favorite-plugin/commit/b6359532fe085d9ea6b7894e997e797806480777