GitHub Advisoryadvisory · Maven

GHSA-f9v6-p7hp-c3qx Missing permission checks in Jenkins P4 Plugin

MEDIUM Published 2022-05-24 Modified 2023-01-14 Official page ↗
Aliases
CVE-2020-2142
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:p4
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-319, CWE-862
Reviewed
2023-01-14

Affected packages

• Maven org.jenkins-ci.plugins:p4: < 1.10.11 → fixed in 1.10.11

Description

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints.

Related

Alias · CVE (1)

  • CVE-2020-2142 A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds. vulnerability

Weakness · CWE (2)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-862 Missing Authorization weakness

References