GitHub Advisoryadvisory · Maven

GHSA-qgv4-7jhx-c72q Missing webhook endpoint authorization in Jenkins Rundeck Plugin

MEDIUM Published 2022-09-22 Modified 2022-12-08 Official page ↗
Aliases
CVE-2022-41234
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:rundeck
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-862
Reviewed
2022-09-23

Affected packages

• Maven org.jenkins-ci.plugins:rundeck: < 3.6.12 → fixed in 3.6.12

Description

Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the `/plugin/rundeck/webhook/` endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.

Related

Alias · CVE (1)

  • CVE-2022-41234 Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References