Jenkins openid Plugin missing permission check

2022-05-1301:25:16

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
org.jenkins-ci.plugins:openideq1.2
org.jenkins-ci.plugins:openideq1.0
org.jenkins-ci.plugins:openideq1.6
org.jenkins-ci.plugins:openideq2.1
org.jenkins-ci.plugins:openideq2.2
org.jenkins-ci.plugins:openideq2.3
org.jenkins-ci.plugins:openideq1.4
org.jenkins-ci.plugins:openideq1.7
org.jenkins-ci.plugins:openideq1.3
org.jenkins-ci.plugins:openideq1.8

Name	Operator	Version
org.jenkins-ci.plugins:openid	eq	1.2
org.jenkins-ci.plugins:openid	eq	1.0
org.jenkins-ci.plugins:openid	eq	1.6
org.jenkins-ci.plugins:openid	eq	2.1
org.jenkins-ci.plugins:openid	eq	2.2
org.jenkins-ci.plugins:openid	eq	2.3
org.jenkins-ci.plugins:openid	eq	1.4
org.jenkins-ci.plugins:openid	eq	1.7
org.jenkins-ci.plugins:openid	eq	1.3
org.jenkins-ci.plugins:openid	eq	1.8