GitHub Advisoryadvisory · Maven

GHSA-mqr8-3v8j-46wv Missing Authorization in Jenkins Configuration as Code Plugin

MEDIUM Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10344
Ecosystem
Maven
Packages
io.jenkins:configuration-as-code
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-285, CWE-862
Reviewed
2022-06-28

Affected packages

• Maven io.jenkins:configuration-as-code: < 1.25 → fixed in 1.25

Description

Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.

Related

Alias · CVE (1)

  • CVE-2019-10344 Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with… vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-862 Missing Authorization weakness

References