Missing permission check in Jenkins Gerrit Trigger Plugin

2022-05-2417:03:46

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.

CPENameOperatorVersion
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.25.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.10.1
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.17.4
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.27.2
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.22.0-beta-1
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.20.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.7.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.17.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.21.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggereq2.9.0

Name	Operator	Version
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.25.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.10.1
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.17.4
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.27.2
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.22.0-beta-1
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.20.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.7.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.17.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.21.0
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger	eq	2.9.0