Описание
Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
Ссылки
- Third Party Advisory
- Vendor Advisory
- Third Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 8.4.4 (включая)
cpe:2.3:a:jenkins:warnings_next_generation:*:*:*:*:*:jenkins:*:*
EPSS
Процентиль: 9%
0.00031
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents
EPSS
Процентиль: 9%
0.00031
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-862