GitHub Advisoryadvisory · Maven

GHSA-4gh2-m88h-8cj8 Disabled permissions can be granted by Jenkins SSH2 Easy Plugin

HIGH Published 2023-09-06 Modified 2024-01-30 Official page ↗
Aliases
CVE-2023-41939
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:ssh2easy
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-281
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:ssh2easy: < 1.6 → fixed in 1.6

Description

Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.

Related

Alias · CVE (1)

  • CVE-2023-41939 Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users… vulnerability

Weakness · CWE (1)

  • CWE-281 Improper Preservation of Permissions weakness

References