GitHub Advisoryadvisory · Maven

GHSA-w5rh-j4g3-jr29 Missing Authorization in Jenkins S3 publisher Plugin

MEDIUM Published 2021-06-16 Modified 2023-05-24 Official page ↗
Aliases
CVE-2021-21651
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:s3
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2021-05-19

Affected packages

• Maven org.jenkins-ci.plugins:s3: >= 0.11.6, < 0.11.7 → fixed in 0.11.7 • Maven org.jenkins-ci.plugins:s3: < 0.11.5.1 → fixed in 0.11.5.1

Description

Jenkins S3 publisher Plugin prior to 0.11.7 and 0.11.5.1 does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to obtain the list of configured profiles. S3 publisher Plugin 0.11.7 and 0.11.5.1 performs permission checks when providing a list of configured profiles.

Related

Alias · CVE (1)

  • CVE-2021-21651 Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References