Jenkins Dynatrace Plugin contains Incorrect Default Permissions

2022-05-2416:59:37

Google

osv.dev

0.001 Low

EPSS

Percentile

28.6%

JSON

A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. This issue was patched in version 2.1.5, however, please

##NOTE: This plugin is marked as DEPRECATED

CPENameOperatorVersion
org.jenkins-ci.plugins:dynatrace-dashboardeq2.1.3
org.jenkins-ci.plugins:dynatrace-dashboardeq2.1.4
org.jenkins-ci.plugins:dynatrace-dashboardeq1.0.5
org.jenkins-ci.plugins:dynatrace-dashboardeq2.1.0
org.jenkins-ci.plugins:dynatrace-dashboardeq2.0.5
org.jenkins-ci.plugins:dynatrace-dashboardeq2.0.4
org.jenkins-ci.plugins:dynatrace-dashboardeq2.0.7

Name	Operator	Version
org.jenkins-ci.plugins:dynatrace-dashboard	eq	2.1.3
org.jenkins-ci.plugins:dynatrace-dashboard	eq	2.1.4
org.jenkins-ci.plugins:dynatrace-dashboard	eq	1.0.5
org.jenkins-ci.plugins:dynatrace-dashboard	eq	2.1.0
org.jenkins-ci.plugins:dynatrace-dashboard	eq	2.0.5
org.jenkins-ci.plugins:dynatrace-dashboard	eq	2.0.4
org.jenkins-ci.plugins:dynatrace-dashboard	eq	2.0.7