Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes

2022-05-1301:48:32

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions.

CPENameOperatorVersion
org.jenkins-ci.plugins:promoted-buildseq2.18
org.jenkins-ci.plugins:promoted-buildseq2.20
org.jenkins-ci.plugins:promoted-buildseq2.10
org.jenkins-ci.plugins:promoted-buildseq2.1
org.jenkins-ci.plugins:promoted-buildseq2.29
org.jenkins-ci.plugins:promoted-buildseq2.31
org.jenkins-ci.plugins:promoted-buildseq2.31.1
org.jenkins-ci.plugins:promoted-buildseq2.3
org.jenkins-ci.plugins:promoted-buildseq2.25
org.jenkins-ci.plugins:promoted-buildseq2.22-beta1

Name	Operator	Version
org.jenkins-ci.plugins:promoted-builds	eq	2.18
org.jenkins-ci.plugins:promoted-builds	eq	2.20
org.jenkins-ci.plugins:promoted-builds	eq	2.10
org.jenkins-ci.plugins:promoted-builds	eq	2.1
org.jenkins-ci.plugins:promoted-builds	eq	2.29
org.jenkins-ci.plugins:promoted-builds	eq	2.31
org.jenkins-ci.plugins:promoted-builds	eq	2.31.1
org.jenkins-ci.plugins:promoted-builds	eq	2.3
org.jenkins-ci.plugins:promoted-builds	eq	2.25
org.jenkins-ci.plugins:promoted-builds	eq	2.22-beta1