GitHub Advisoryadvisory · Maven

GHSA-xxhf-xq6v-c8mj Improper authorization in Jenkins Embeddable Build Status Plugin bypasses ViewStatus permission requirement

MEDIUM Published 2022-06-24 Modified 2022-12-05 Official page ↗
Aliases
CVE-2022-34180
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:embeddable-build-status
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862, CWE-863
Reviewed
2022-07-05

Affected packages

• Maven org.jenkins-ci.plugins:embeddable-build-status: < 2.0.4 → fixed in 2.0.4

Description

Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for \"unprotected\" status badge access. This allows attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build. Embeddable Build Status Plugin 2.0.4 requires ViewStatus permission to obtain the build status badge icon.

Related

Alias · CVE (1)

  • CVE-2022-34180 Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References