CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when configuring existing GitHub organization folders. This allowed users with read access to the GitHub organization folder to reconfigure it, including changing the GitHub API endpoint for the organization folder to an attacker-controlled server to obtain the GitHub access token, if the organization folder was initially created using Blue Ocean.

• CWE-287

• https://jenkins.io/security/advisory/2017-08-07/Vendor Advisory
• https://jenkins.io/security/advisory/2017-08-07/Vendor Advisory

Published

Oct 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000104The Config File Provider Plugin is used to centrally manage …
• CVE-2017-1000105The optional Run/Artifacts permission can be enabled by sett…
• CVE-2017-1000106Blue Ocean allows the creation of GitHub organization folder…
• CVE-2017-1000107Script Security Plugin did not apply sandboxing restrictions…
• CVE-2017-1000108The Pipeline: Input Step Plugin by default allowed users wit…
• CVE-2017-1000109The custom Details view of the Static Analysis Utilities bas…
• CVE-2017-1000111Linux kernel: heap out-of-bounds in AF_PACKET sockets. This …7.8
• CVE-2017-1000112Linux kernel: Exploitable memory corruption due to UFO to no…7
• CVE-2017-1000113The Deploy to container Plugin stored passwords unencrypted …
• CVE-2017-1000114The Datadog Plugin stores an API key to access the Datadog s…
• CVE-2017-1000115Mercurial prior to version 4.3 is vulnerable to a missing sy…
• CVE-2017-1000116Mercurial prior to 4.3 did not adequately sanitize hostnames…