GitHub Advisoryadvisory · Maven

GHSA-5293-3fgp-cr3x Missing permission checks in Jenkins Periodic Backup Plugin allow every user to change settings

HIGH Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2017-1000086
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:periodicbackup
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-862
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:periodicbackup: < 1.5 → fixed in 1.5

Description

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

Related

Alias · CVE (1)

  • CVE-2017-1000086 The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings,… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References