GitHub Advisoryadvisory · Maven

GHSA-5hw2-327v-vvr6 Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2020-2282
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:implied-labels
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2022-12-19

Affected packages

• Maven org.jenkins-ci.plugins:implied-labels: < 0.7 → fixed in 0.7

Description

Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to configure the plugin. Implied Labels Plugin 0.7 requires Overall/Administer permission to configure the plugin.

Related

Alias · CVE (1)

  • CVE-2020-2282 Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References