GitHub Advisoryadvisory · Maven

GHSA-vhh3-mvc4-hhq6 Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks

MEDIUM Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2017-1000388
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:depgraph-view
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:depgraph-view: < 0.13 → fixed in 0.13

Description

Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data.

Related

Alias · CVE (1)

  • CVE-2017-1000388 Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References