Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks. Plugins like Authorize Project Plugin allow changing the authentication associated with a build. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins. External References: https://jenkins.io/security/advisory/2017-07-10/
Acknowledgments: Name: the Jenkins project
Statement: This issue affects the versions of jenkins-plugin-pipeline-build-step as shipped with Red Hat OpenShift Enterprise 3. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.