GitHub Advisoryadvisory · Maven

GHSA-c4c3-3cgh-vvrh Missing permission check in Jenkins requests-plugin Plugin allows viewing pending requests

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21674
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:requests
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2022-12-16

Affected packages

• Maven org.jenkins-ci.plugins:requests: < 2.2.7 → fixed in 2.2.7

Description

Jenkins requests-plugin Plugin 2.2.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to view the list of pending requests. Jenkins requests-plugin Plugin 2.2.7 requires Overall/Administer permission to view the list of pending requests. The previous sentence originally stated that Overall/Read permission was newly required. This statement was incorrect and has been fixed on 2021-07-05.

Related

Alias · CVE (1)

  • CVE-2021-21674 A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References