Описание
Missing permission check in Jenkins Gerrit Trigger Plugin
A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.
Пакеты
Наименование
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger
maven
Затронутые версииВерсия исправления
< 2.30.2
2.30.2
Связанные уязвимости
CVSS3: 5.4
nvd
около 6 лет назад
A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.