GitHub Advisoryadvisory · Maven

GHSA-vc7g-4269-f7hw Missing permission check in Blue Ocean Plugin

MEDIUM Published 2022-05-24 Modified 2022-12-29 Official page ↗
Aliases
CVE-2020-2255
Ecosystem
Maven
Packages
io.jenkins.blueocean:blueocean
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2022-12-29

Affected packages

• Maven io.jenkins.blueocean:blueocean: < 1.23.3 → fixed in 1.23.3

Description

Updated 2020-09-16 This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it. Original Description Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Blue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.

Related

Alias · CVE (1)

  • CVE-2020-2255 A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References