GitHub Advisoryadvisory · Maven

GHSA-xv69-6rf3-w5g2 Missing permission check in Jenkins Cloud Statistics Plugin

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21631
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:cloud-stats
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2022-12-15

Affected packages

• Maven org.jenkins-ci.plugins:cloud-stats: < 0.27 → fixed in 0.27

Description

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages. Jenkins Cloud Statistics Plugin 0.27 requires Overall/Administer permission to access provisioning exception error messages.

Related

Alias · CVE (1)

  • CVE-2021-21631 Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References