Missing permission check in Jenkins sinatra-chef-builder Plugin

2022-05-1301:25:16

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.0%

JSON

A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
org.jenkins-ci.plugins:sinatra-chef-buildereq1.3
org.jenkins-ci.plugins:sinatra-chef-buildereq1.15
org.jenkins-ci.plugins:sinatra-chef-buildereq1.14
org.jenkins-ci.plugins:sinatra-chef-buildereq1.20

Name	Operator	Version
org.jenkins-ci.plugins:sinatra-chef-builder	eq	1.3
org.jenkins-ci.plugins:sinatra-chef-builder	eq	1.15
org.jenkins-ci.plugins:sinatra-chef-builder	eq	1.14
org.jenkins-ci.plugins:sinatra-chef-builder	eq	1.20