GitHub Advisoryadvisory · Maven

GHSA-fvfc-8pqr-wjpv Missing Authorization in Jenkins S3 publisher Plugin

MEDIUM Published 2021-06-16 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21650
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:s3
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2021-05-19

Affected packages

• Maven org.jenkins-ci.plugins:s3: >= 0.11.6, < 0.11.7 → fixed in 0.11.7 • Maven org.jenkins-ci.plugins:s3: < 0.11.5.1 → fixed in 0.11.5.1

Description

Jenkins S3 publisher Plugin prior to 0.11.7 and 0.11.5.1 does not perform Run/Artifacts permission checks in various HTTP endpoints and API models. This allows attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled. Jenkins S3 publisher Plugin 0.11.7 and 0.11.5.1 requires Run/Artifacts permission to obtain information about artifacts if this permission is enabled.

Related

Alias · CVE (1)

  • CVE-2021-21650 Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models,… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References