Improper authorization in Jenkins Job and Node Ownership Plugin

2022-05-1301:48:31

Google

osv.dev

0.001 Low

EPSS

Percentile

23.0%

JSON

An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in

OwnershipDescription.java, 
JobOwnerJobProperty.java, 
and OwnerNodeProperty.java

that allow an attacker with Job/Configure or Computer/Configure permission and without Ownership related permissions to override ownership metadata.

CPENameOperatorVersion
com.synopsys.jenkinsci:ownershipeq0.5
com.synopsys.jenkinsci:ownershipeq0.7
com.synopsys.jenkinsci:ownershipeq0.9.1
com.synopsys.jenkinsci:ownershipeq0.8
com.synopsys.jenkinsci:ownershipeq0.6
com.synopsys.jenkinsci:ownershipeq0.10.0
com.synopsys.jenkinsci:ownershipeq0.3.1
com.synopsys.jenkinsci:ownershipeq0.5.1
com.synopsys.jenkinsci:ownershipeq0.11.0
com.synopsys.jenkinsci:ownershipeq0.4

Name	Operator	Version
com.synopsys.jenkinsci:ownership	eq	0.5
com.synopsys.jenkinsci:ownership	eq	0.7
com.synopsys.jenkinsci:ownership	eq	0.9.1
com.synopsys.jenkinsci:ownership	eq	0.8
com.synopsys.jenkinsci:ownership	eq	0.6
com.synopsys.jenkinsci:ownership	eq	0.10.0
com.synopsys.jenkinsci:ownership	eq	0.3.1
com.synopsys.jenkinsci:ownership	eq	0.5.1
com.synopsys.jenkinsci:ownership	eq	0.11.0
com.synopsys.jenkinsci:ownership	eq	0.4