GitHub Advisoryadvisory · Maven

GHSA-3jp6-q9cg-rvgj Missing permission check in Jenkins build-publisher Plugin

MEDIUM Published 2022-09-22 Modified 2022-12-06 Official page ↗
Aliases
CVE-2022-41230
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:build-publisher
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862, CWE-863
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:build-publisher: <= 1.22 (no fix yet)

Description

Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers. At this time there is no known workaround or fix. The Build-Publisher plugin distribution has been suspended.

Related

Alias · CVE (1)

  • CVE-2022-41230 Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References