GitHub Advisoryadvisory · Maven

GHSA-jr86-6j4j-mv45 Jenkins Assembla merge request builder Plugin missing authentication to access endpoint

MEDIUM Published 2023-04-12 Modified 2023-04-21 Official page ↗
Aliases
CVE-2023-30521
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:assembla-merge-request-builder
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2023-04-12

Affected packages

• Maven org.jenkins-ci.plugins:assembla-merge-request-builder: <= 1.1.13 (no fix yet)

Description

Jenkins Assembla merge request builder Plugin provides a webhook endpoint at `/assembla-webhook/` that can be used to trigger builds of jobs configured to use a specified repository. In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

Related

Alias · CVE (1)

  • CVE-2023-30521 A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References