GitHub Advisoryadvisory · Maven

GHSA-9rx5-w522-5fh7 Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes

MEDIUM Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2018-1000114
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:promoted-builds
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:promoted-builds: < 3.0 → fixed in 3.0

Description

An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions.

Related

Alias · CVE (1)

  • CVE-2018-1000114 An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References