GitHub Advisoryadvisory · Maven

GHSA-268v-2qq7-84pf Missing permission check in Jenkins Favorite Plugin

MEDIUM Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2017-1000243
Ecosystem
Maven
Packages
org.jvnet.hudson.plugins:favorite
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2024-01-30

Affected packages

• Maven org.jvnet.hudson.plugins:favorite: < 2.3.0 → fixed in 2.3.0

Description

Jenkins Favorite Plugin up to and including 2.1.0 does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites

Related

Alias · CVE (1)

  • CVE-2017-1000243 Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References