GitHub Advisoryadvisory · Maven

GHSA-xh9c-vcf9-h94m Jenkins Git server Plugin does not perform a permission check

MEDIUM Published 2024-05-02 Modified 2024-07-03 Official page ↗
Aliases
CVE-2024-34146
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:git-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-269
Reviewed
2024-05-03

Affected packages

• Maven org.jenkins-ci.plugins:git-server: < 117.veb → fixed in 117.veb

Description

Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH. This allows attackers with a previously configured SSH public key but lacking Overall/Read permission to access Git repositories. Git server Plugin 117.veb_68868fa_027 requires Overall/Read permission to access Git repositories over SSH.

Related

Alias · CVE (1)

  • CVE-2024-34146 Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH,… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References