Описание
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.3 (включая)
cpe:2.3:a:jenkins:embeddable_build_status:*:*:*:*:*:jenkins:*:*
EPSS
Процентиль: 70%
0.00648
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 5.3
github
около 3 лет назад
Improper authorization in Jenkins Embeddable Build Status Plugin bypasses ViewStatus permission requirement
EPSS
Процентиль: 70%
0.00648
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-863