CVE-2017-1000390

Vulnerability

Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action [1][2]. This allows any user with Job/Read permission to resume a build, even if they lack the intended Job/Build or other permissions typically required to trigger or resume builds [1].

Exploitation

An attacker needs only Job/Read permission on a Jenkins job using the Multijob plugin [1]. With that access, the attacker can navigate to the Resume Build action and resume a previously failed or aborted build, bypassing any required authentication for the resume operation [1][2].

Impact

An attacker with Job/Read permission can resume builds without authorization, potentially causing unauthorized build execution, resource consumption, or triggering downstream tasks that the attacker should not be able to start [1]. The impact is primarily on availability and integrity of build processes, as an attacker can restart builds that might have been intentionally stopped or that are in a sensitive state [1][2].

Mitigation

Jenkins has fixed this issue by adding permission checks in version 1.26 of the Multijob plugin [1][2]. Users should update to version 1.26 or later. No workarounds are documented; upgrading is the recommended mitigation [1][2].